---
id: CVE-2026-43115
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  srcu: Use irq_work to start GP in tiny SRCU

  Tiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(),
  which acquires the workqueue pool->lock.

  This causes…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  srcu: Use irq_work to start GP in tiny SRCU

  Tiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(),
  which acquires the workqueue pool->lock.

  This causes…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.12, < 6.19.14'
  - linux_kernel = 7.0
patched:
  - linux_kernel 6.19.14
published: '2026-05-06'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:30.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-43115'
references:
  - url: 'https://git.kernel.org/stable/c/28768bc7ea0b13f558a70f63cc3cfcd32d55d488'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a6fc88b22bc8d12ad52e8412c667ec0f5bf055af'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bb37286db65368cb72ba8757ad86299c4e4a73fc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00143
epssPercentile: 0.03219
ingestedAt: '2026-10-15T11:00:41.712Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

srcu: Use irq_work to start GP in tiny SRCU

Tiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(),
which acquires the workqueue pool->lock.

This causes a lockdep splat when call_srcu() is called with a scheduler
lock held, due to:

  call_srcu() [holding pi_lock]
    srcu_gp_start_if_needed()
      schedule_work() -> pool->lock

  workqueue_init() / create_worker() [holding pool->lock]
    wake_up_process() -> try_to_wake_up() -> pi_lock

Also add irq_work_sync() to cleanup_srcu_struct() to prevent a
use-after-free if a queued irq_work fires after cleanup begins.

Tested with rcutorture SRCU-T and no lockdep warnings.

[ Thanks to Boqun for similar fix in patch "rcu: Use an intermediate irq_work
to start process_srcu()" ]

## Affected

- `linux_kernel >= 4.12, < 6.19.14`
- `linux_kernel = 7.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.14`