PT-2026-61259 · Linux · Linux
CVE-2026-63942
·
Published
2026-07-19
·
Updated
2026-07-19
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
parport: Fix race between port and client registration
The parport subsystem registers port devices before they are fully
initialised, resulting in a race condition where client drivers such
as lp can attach to ports that are not completely initialised or even
being torn down.
When the port and client drivers are built as modules and loaded
around the same time during boot, this occasionally results in a
crash. I was able to make this happen reliably in a VM with a
PC-style parallel port by patching parport pc to fail probing:
--- a/drivers/parport/parport pc.c +++ b/drivers/parport/parport pc.c @@ -2069,7 +2069,7 @@ static struct parport * parport pc probe port(unsigned long int base, if (!p) goto out3;
- base res = request region(base, 3, p->name);
- base res = NULL; if (!base res) goto out4;
and then running:
while true; do
modprobe lp & modprobe parport pc
wait
rmmod lp parport pc
done
for a few seconds.
In the long term I think port registration should be changed to put
the call to device add() inside parport announce port(), but since the
latter currently cannot fail this will require changing all port
drivers.
For now, add a flag to indicate whether a port has been "announced"
and only try to attach client drivers to ports when the flag is set.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux