{"id":"CVE-2026-43115","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nsrcu: Use irq_work to start GP in tiny SRCU\n\nTiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(),\nwhich acquires the workqueue pool->lock.\n\nThis causes…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nsrcu: Use irq_work to start GP in tiny SRCU\n\nTiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(),\nwhich acquires the workqueue pool->lock.\n\nThis causes…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.12, < 6.19.14","linux_kernel = 7.0"],"patched":["linux_kernel 6.19.14"],"published":"2026-05-06","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:17:30.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-43115","references":[{"url":"https://git.kernel.org/stable/c/28768bc7ea0b13f558a70f63cc3cfcd32d55d488","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb37286db65368cb72ba8757ad86299c4e4a73fc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00143,"epssPercentile":0.03219,"ingestedAt":"2026-10-15T11:00:41.712Z","slug":"CVE-2026-43115","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nsrcu: Use irq_work to start GP in tiny SRCU\n\nTiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(),\nwhich acquires the workqueue pool->lock.\n\nThis causes a lockdep splat when call_srcu() is called with a scheduler\nlock held, due to:\n\n  call_srcu() [holding pi_lock]\n    srcu_gp_start_if_needed()\n      schedule_work() -> pool->lock\n\n  workqueue_init() / create_worker() [holding pool->lock]\n    wake_up_process() -> try_to_wake_up() -> pi_lock\n\nAlso add irq_work_sync() to cleanup_srcu_struct() to prevent a\nuse-after-free if a queued irq_work fires after cleanup begins.\n\nTested with rcutorture SRCU-T and no lockdep warnings.\n\n[ Thanks to Boqun for similar fix in patch \"rcu: Use an intermediate irq_work\nto start process_srcu()\" ]\n\n## Affected\n\n- `linux_kernel >= 4.12, < 6.19.14`\n- `linux_kernel = 7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.19.14`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":222268,"id":"CVE-2026-43115","ts":1792065863347,"field":"cvss","old":null,"new":"5.5"},{"seq":222267,"id":"CVE-2026-43115","ts":1792065863347,"field":"severity","old":"none","new":"medium"}]}