PT-2026-30147 · Linux · Linux Kernel

Published 2026-04-03 · Updated 2026-05-03 · CVE-2026-23452

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the pm runtime work() function related to device removal, potentially leading to a use-after-free issue. The issue occurs when the parent device is freed while the function is attempting to suspend it. This can be triggered by blktest block/001. The vulnerability involves a potential dereference of the dev->parent pointer after the parent device has been freed. The fix involves inserting a flush work() call in pm runtime remove().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-23452

ECHO-80A7-9E98-AE93

OESA-2026-1950

OESA-2026-2172

OESA-2026-2176

Affected Products

Linux Kernel

References · 63

• https://nvd.nist.gov/vuln/detail/CVE-2026-23269 · Security Note
• https://git.kernel.org/stable/c/29ab768277617452d88c0607c9299cdc63b6e9ff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23398 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23407 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-39794 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-23452 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71089 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23442 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31788 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31427 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31428 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-50518 · Security Note