CVE-2026-43115

Vulnerability

Analysis

CVE-2026-43115 addresses a lock ordering issue in the Linux kernel's tiny SRCU (Sleepable Read-Copy-Update) implementation. The root cause is that srcu_gp_start_if_needed() directly calls schedule_work(), which acquires the workqueue pool lock. When call_srcu() is invoked while holding a scheduler lock (such as pi_lock), this creates a circular lock dependency: call_srcu() → srcu_gp_start_if_needed() → schedule_work() → pool lock, while the workqueue initialization path holds the pool lock and then acquires pi_lock via wake_up_process(). This results in a lockdep splat [1].

Exploitation and

Impact

The vulnerability is triggered by calling call_srcu() while holding a scheduler lock, which can occur in various kernel contexts. No special privileges are required beyond the ability to invoke SRCU callbacks in such a context. The impact is a lockdep warning and potential deadlock, which can lead to system instability or denial of service. An attacker who can control the timing of SRCU callbacks might exploit this to cause a system hang [1].

Mitigation

The fix replaces the direct schedule_work() call with irq_work, which avoids acquiring the problematic pool lock. Additionally, irq_work_sync() is added to cleanup_srcu_struct() to prevent a use-after-free if a queued irq_work fires after cleanup begins. The patch has been tested with rcutorture SRCU-T and shows no lockdep warnings. It is included in the stable kernel tree [1][2].