CVE-2026-43147: Linux Kernel SR-IOV DOS Vulnerability

CVE-2026-43147 Overview

CVE-2026-43147 is a Linux kernel vulnerability in the PCI/IOV subsystem that causes a deadlock when enabling or disabling Single Root I/O Virtualization (SR-IOV). The issue stems from a previous commit (05703271c3cd) that added pci_rescan_remove_lock locking around SR-IOV enable/disable operations. The lock is taken recursively when sriov_del_vfs() runs as part of pci_stop_and_remove_bus_device(), producing a self-deadlock. The fix reverts the offending commit, restoring kernel availability at the cost of reintroducing the original race the commit attempted to address. A follow-on patch is planned to provide a complete fix.

Critical Impact

Local users with permission to write to PCI sysfs entries can trigger a kernel deadlock by disabling Virtual Functions (VFs) and removing the Physical Function (PF) device, leading to denial of service on systems using SR-IOV-capable devices such as Mellanox mlx5 adapters.

Affected Products

• Linux kernel versions containing commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV")
• Systems with SR-IOV-capable PCIe devices, including Mellanox mlx5 network adapters
• Stable kernel branches referenced by patches 0de341b, 2fa119c, 40f6768, 5867778, 6392652, 83651d3, d47f27e, and f61cdd7

Discovery Timeline

• 2026-05-06 - CVE-2026-43147 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43147

Vulnerability Analysis

The defect lives in the Linux kernel PCI SR-IOV management path. When user space writes to /sys/bus/pci/devices/<pf>/remove, the kernel calls pci_stop_and_remove_bus_device_locked(), which acquires pci_rescan_remove_lock. The teardown chain then invokes the device driver's remove handler, which for mlx5_core calls mlx5_sriov_disable() and ultimately sriov_disable(). The cited commit added a second acquisition of the same pci_rescan_remove_lock inside sriov_disable(), creating a recursive lock attempt on a non-recursive mutex. The kernel's lockdep subsystem detects this as a deadlock condition and the calling thread blocks indefinitely.

Root Cause

The root cause is a lock ordering and reentrancy violation. Commit 05703271c3cd introduced pci_rescan_remove_lock acquisition in sriov_disable() to serialize SR-IOV state changes. However, sriov_del_vfs() is reachable from device removal paths that already hold the same lock. Because pci_rescan_remove_lock is implemented as a non-recursive mutex, the second acquisition by the same task triggers a self-deadlock rather than an immediate panic.

Attack Vector

A local user or process with write access to PCI sysfs entries can trigger the deadlock by first writing a non-zero value to sriov_numvfs and then writing 1 to the remove attribute of the same Physical Function. The deadlock hangs the writing task and any subsequent operation that requires pci_rescan_remove_lock, producing a denial-of-service condition. The trace excerpt published with the CVE shows the deadlock observed on a mlx5 device through the call path remove_store → pci_stop_and_remove_bus_device_locked → pci_device_remove → mlx5_sriov_disable → sriov_disable.

No verified public exploit code is available. The vulnerability is described in the upstream kernel commits referenced in the NVD entry. See the Kernel Commit 0de341b and Kernel Commit f61cdd7 for the revert and follow-on fixes.

Detection Methods for CVE-2026-43147

Indicators of Compromise

• Kernel log entries containing print_deadlock_bug and pci_rescan_remove_lock with stack frames including sriov_disable+0x34/0x140 and pci_stop_and_remove_bus_device_locked.
• Hung task warnings (INFO: task <name>:<pid> blocked for more than X seconds) referencing processes performing writes to PCI sriov_numvfs or remove sysfs entries.
• System administrator processes stuck in D state after issuing SR-IOV teardown commands on mlx5 or other SR-IOV-capable devices.

Detection Strategies

• Audit kernel ring buffer (dmesg) and persistent journal (journalctl -k) for lockdep deadlock reports referencing pci_rescan_remove_lock.
• Monitor for shell or automation scripts writing to /sys/bus/pci/devices/*/sriov_numvfs followed by writes to /sys/bus/pci/devices/*/remove on the same Physical Function.
• Track running kernel versions across the fleet against the list of stable branches that received the revert commit.

Monitoring Recommendations

• Enable CONFIG_PROVE_LOCKING in test kernels to surface lockdep deadlock reports during pre-production validation.
• Forward kernel logs to a centralized logging or SIEM platform and alert on the strings print_deadlock_bug, pci_rescan_remove_lock, and sriov_disable.
• Inventory hosts with SR-IOV enabled by polling lspci -vv and /sys/bus/pci/devices/*/sriov_numvfs so patch coverage can be measured.

How to Mitigate CVE-2026-43147

Immediate Actions Required

• Update the Linux kernel to a stable release that includes the revert of commit 05703271c3cd (see referenced commits 0de341b, 2fa119c, 40f6768, 5867778, 6392652, 83651d3, d47f27e, f61cdd7).
• Restrict write access to /sys/bus/pci/devices/*/sriov_numvfs and /sys/bus/pci/devices/*/remove to root only and audit any automation that interacts with these paths.
• Avoid issuing PF remove operations while VFs are still active until the patched kernel is deployed.

Patch Information

The upstream fix reverts commit 05703271c3cd. The revert is propagated across stable branches via the kernel.org commits 0de341b2365bad430aade0853fe09c2cbe468f59, 2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a, 40f67686a5002c0c322fac918406bbc8d9c2ec2f, 58677783c89681871077f50a7042b0c6380c4fd8, 639265296fe6ee21b6f00e00ee2bab65f3b07252, 83651d37474c762920e345a3a0828f975ca4d732, d47f27e145f8bd13f3c230da5e3af29225b4a2f7, and f61cdd7e9b67bb8961b0a81bf294b78343e5db05. The kernel maintainers note this revert restores the original race condition the cited commit tried to solve and that a follow-on fix will be provided.

Workarounds

• Configure SR-IOV VFs at boot time and avoid runtime changes to sriov_numvfs on production hosts until patched.
• Disable VFs (echo 0 > sriov_numvfs) and confirm completion before removing the PF device, rather than relying on driver-initiated VF teardown during remove.
• Constrain administrative tooling to serialize PCI hot-remove operations and prevent concurrent SR-IOV reconfiguration on the same device.

# Verify running kernel and check whether the revert is applied
uname -r
git log --oneline | grep -E '05703271c3cd|Revert.*PCI/IOV'

# Safely tear down SR-IOV before removing a PF (workaround)
PF=0000:01:00.0
echo 0 | sudo tee /sys/bus/pci/devices/${PF}/sriov_numvfs
sudo udevadm settle
sudo sh -c "echo 1 > /sys/bus/pci/devices/${PF}/remove"