rpmsg: glink: fix deadlock in endpoint destroy during driver detach

Description

In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: fix deadlock in endpoint destroy during driver detach During driver detach, the device core holds the device mutex throughout the driver's remove callback chain. When the rpmsg endpoint is destroyed as part of that teardown, the GLINK endpoint destroy implementation attempts to unregister the underlying rpmsg device. That unregistration calls device_del(), which tries to re-acquire the same device mutex already held higher up the stack, causing rmmod to hang indefinitely. The deadlock manifests with the following call chain: [<0>] device_del+0x44/0x414  <- tries to acquire same mutex [<0>] device_unregister+0x18/0x34 [<0>] rpmsg_unregister_device+0x28/0x4c [<0>] qcom_glink_remove_rpmsg_device+0x70/0xc0 [<0>] qcom_glink_destroy_ept+0x58/0xbc [<0>] rpmsg_dev_remove+0x50/0x60 [<0>] device_remove+0x4c/0x80 [<0>] device_release_driver_internal+0x1cc/0x228 <- acquires device mutex [<0>] driver_detach+0x4c/0x98 [<0>] bus_remove_driver+0x6c/0xbc [<0>] driver_unregister+0x30/0x60 [<0>] unregister_rpmsg_driver+0x10/0x1c [<0>] fastrpc_exit+0x28/0x38 [fastrpc] [<0>] __arm64_sys_delete_module+0x1b8/0x294 [<0>] invoke_syscall+0x48/0x10c [<0>] el0_svc_common.constprop.0+0xc0/0xe0 [<0>] do_el0_svc+0x1c/0x28 [<0>] el0_svc+0x34/0x108 [<0>] el0t_64_sync_handler+0xa0/0xe4 [<0>] el0t_64_sync+0x198/0x19c The rpmsg device unregistration inside endpoint destroy is redundant. In both contexts where endpoint destruction is triggered: - Driver detach path: the driver core already tears down the rpmsg device. - Channel close path: the rpmsg device is already unregistered before endpoint destruction is reached. Remove the redundant unregistration to fix the deadlock.

Timeline

Scores

No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.

EPSS (exploitation in 30 days)

0.22% · top 88% of all CVEs (11 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.

Affected products

• Linux · Linux

  • affected 93b6b9e4acff4794e7426d3ad64ef14e3b3e8919 – < 73092c2292aa65515671e54abbcda2166d3827ed
  • affected 24fd02c3a4798de7dc94b55d36a1685fe6cdaf69 – < bbc236357876d35a624030e5c50eedbc380be98e
  • affected 32fe8cdf541863239b81c80b8b04112d6e8792cf – < 8597f669a5268e0dcf243e2b2d6ca00370117057
  • affected c6210714347f72bae8e7142dc0a7f99923c466e7 – < 48f55b90f0d713e477e26b85d7327d9592d016f9
  • affected fcab5c2672f8dac3d77013dbe047b2441f4141f5 – < cbcdf96e1c87bc07055d04264018ded1f3bafffb
  • affected f80e4e91b010ee7d6c52f24d069975ac955ac6b2 – < ecad679e2b92c419cc22cc8f257cd457d5192647
  • affected a53e356df548f6b0e82529ef3cc6070f42622189 – < e559626bee8a6632aafc08eedcdb4bf26ca245c5
  • affected a53e356df548f6b0e82529ef3cc6070f42622189 – < 5a5a48e788e02fd8a8eb7188ce440572d6c12418
  • affected 5.10.248 – < 5.10.270
  • affected 5.15.198 – < 5.15.221
  • affected 6.1.160 – < 6.1.188
  • affected 6.6.120 – < 6.6.157
  • affected 6.12.64 – < 6.12.110
  • affected 6.18.3 – < 6.18.52

• Linux · Linux

  • affected 6.19
  • unaffected < 6.19
  • unaffected 5.10.270 – ≤ 5.10.*
  • unaffected 5.15.221 – ≤ 5.15.*
  • unaffected 6.1.188 – ≤ 6.1.*
  • unaffected 6.6.157 – ≤ 6.6.*
  • unaffected 6.12.110 – ≤ 6.12.*
  • unaffected 6.18.52 – ≤ 6.18.*
  • unaffected 7.2.6 – ≤ 7.2.*
  • unaffected 7.3 – ≤ *

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-82206 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-93098](https://cveledger.app/badge/CVE-2026-93098.svg)](https://cveledger.app/cve/CVE-2026-93098)

Record last updated 19 Oct 2026, 09:05 UTC.