CVE-2026-97479: Linux Kernel Device Link Warning Vulnerability

CVE-2026-97479 Overview

CVE-2026-97479 is a Linux kernel driver core issue in the device links subsystem. The flaw triggers a WARNING at drivers/base/core.c:1497 in __device_links_no_driver() during driver removal. The warning fires when a consumer device is removed while its supplier is already in the DL_DEV_UNBINDING state. The condition is legitimate during cascading unbind sequences but is incorrectly flagged by the kernel's assertion logic. The issue was observed with the lan966x_pci driver and a device topology involving I2C, pinctrl, an OIC interrupt controller, and a PCI device.

Critical Impact
The flaw produces a kernel warning and noisy stack trace during driver removal. It does not grant code execution or privilege escalation, but it pollutes kernel logs and may mask real device-link failures during teardown.

Affected Products

Linux kernel versions containing the device links driver core logic in drivers/base/core.c
Systems using the lan966x_pci driver with the I2C, pinctrl, and OIC topology
Any driver stack that produces cascading supplier/consumer unbinding sequences

Discovery Timeline

2026-09-24 - CVE-2026-97479 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-97479

Vulnerability Analysis

The Linux driver core maintains device links that express consumer-to-supplier dependencies between devices. During cascading teardown, device_release_driver_internal() calls device_links_unbind_consumers(), which recursively unbinds dependent devices. In the reported topology, I2C depends on both pinctrl and the OIC interrupt controller, while pinctrl also depends on the OIC. When the PCI device is removed, the kernel walks the dependency graph and begins unbinding each supplier in order.

The warning in __device_links_no_driver() enforces an invariant that a consumer being torn down should only see suppliers whose links state is DL_DEV_DRIVER_BOUND, unless the link has the DL_FLAG_SYNC_STATE_ONLY flag. The invariant does not account for recursive unbind cascades where an upstream supplier has already transitioned to DL_DEV_UNBINDING before the downstream consumer finishes its own teardown.

Root Cause

The root cause is an overly strict assertion in __device_links_no_driver(). When I2C unbinds, the OIC supplier link is in state DL_STATE_ACTIVE but the OIC itself has links status DL_DEV_UNBINDING because its own unbind path initiated the I2C teardown. The pre-patch code treated this as unexpected and emitted a WARN, even though the state is legitimate for nested supplier unbinding.

Attack Vector

There is no remote or local attack vector. The condition is triggered by normal driver removal operations such as rmmod or hot-unplug of a PCI device whose driver stack has nested supplier/consumer dependencies. The impact is limited to kernel log noise and a stack trace in dmesg.

See the upstream fix at Kernel Git Commit Fix and the related change at Kernel Git Commit Update for the exact source changes.

Detection Methods for CVE-2026-97479

Indicators of Compromise

Kernel log entries containing WARNING: CPU: X PID: Y at drivers/base/core.c:1497 __device_links_no_driver
Stack traces that include device_links_unbind_consumers and device_release_driver_internal in a recursive pattern
Occurrences during module unload of drivers such as lan966x_pci or similar PCI drivers with layered supplier dependencies

Detection Strategies

Monitor dmesg and /var/log/kern.log for the specific warning signature at drivers/base/core.c:1497
Correlate the warning with driver unbind events in udev or systemd journal output
Check running kernel version against the stable commits referenced in the upstream fix

Monitoring Recommendations

Forward kernel log events to a centralized log aggregator and alert on __device_links_no_driver warnings
Baseline expected kernel warnings during device hot-unplug or module unload operations
Track kernel package versions across the fleet to confirm patch adoption

How to Mitigate CVE-2026-97479

Immediate Actions Required

Apply the stable kernel update that includes the fix for __device_links_no_driver() cascading unbind handling
Identify systems running lan966x_pci or similar drivers with multi-level supplier/consumer topologies and prioritize them for patching
Suppress unnecessary unbind/rebind operations in production until the patched kernel is deployed

Patch Information

The fix updates __device_links_no_driver() to accept the case where a supplier's links status is DL_DEV_UNBINDING, treating it as a legitimate state during cascading teardown rather than emitting a warning. The upstream commit is available at Kernel Git Commit Fix, with a related change at Kernel Git Commit Update. Rebuild the kernel from a stable branch that includes these commits, or install the vendor-backported package.

Workarounds

Avoid frequent module unload cycles for drivers that exhibit the warning until the patched kernel is in place
Filter the specific __device_links_no_driver warning in log pipelines to prevent alert fatigue, while retaining the raw entries for audit
Where possible, perform full system reboots instead of selective driver unbind operations on affected hardware

bash

# Confirm the running kernel includes the fix commit
uname -r
zcat /proc/config.gz | grep CONFIG_LOCALVERSION

# Check dmesg for the warning signature
dmesg -T | grep -A 20 '__device_links_no_driver'