CVE-2026-97479

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> driver core: Avoid warning when removing a device while its supplier is unbinding<br /> <br /> During driver removal, the following warning can appear:<br /> WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 __device_links_no_driver+0xcc/0xfc<br /> ...<br /> Call trace:<br /> __device_links_no_driver+0xcc/0xfc (P)<br /> device_links_driver_cleanup+0xa8/0xf0<br /> device_release_driver_internal+0x208/0x23c<br /> device_links_unbind_consumers+0xe0/0x108<br /> device_release_driver_internal+0xec/0x23c<br /> device_links_unbind_consumers+0xe0/0x108<br /> device_release_driver_internal+0xec/0x23c<br /> device_links_unbind_consumers+0xe0/0x108<br /> device_release_driver_internal+0xec/0x23c<br /> driver_detach+0xa0/0x12c<br /> bus_remove_driver+0x6c/0xbc<br /> driver_unregister+0x30/0x60<br /> pci_unregister_driver+0x20/0x9c<br /> lan966x_pci_driver_exit+0x18/0xa90 [lan966x_pci]<br /> <br /> This warning is triggered when a consumer is removed because the links<br /> status of its supplier is not DL_DEV_DRIVER_BOUND and the link flag<br /> DL_FLAG_SYNC_STATE_ONLY is not set.<br /> <br /> The topology in terms of consumers/suppliers used was the following<br /> (consumer ---&gt; supplier):<br /> <br /> i2c -----------&gt; OIC ----&gt; PCI device<br /> | ^<br /> | |<br /> +---&gt; pinctrl ---+<br /> <br /> When the PCI device is removed, the OIC (interrupt controller) has to be<br /> removed. In order to remove the OIC, pinctrl and i2c need to be removed<br /> and to remove pinctrl, i2c need to be removed. The removal order is:<br /> 1) i2c<br /> 2) pinctrl<br /> 3) OIC<br /> 4) PCI device<br /> <br /> In details, the removal sequence is the following (with 0000:01:00.0 the<br /> PCI device):<br /> driver_detach: call device_release_driver_internal(0000:01:00.0)...<br /> device_links_busy(0000:01:00.0):<br /> links-&gt;status = DL_DEV_UNBINDING<br /> device_links_unbind_consumers(0000:01:00.0):<br /> 0000:01:00.0--oic link-&gt;status = DL_STATE_SUPPLIER_UNBIND<br /> call device_release_driver_internal(oic)...<br /> device_links_busy(oic):<br /> links-&gt;status = DL_DEV_UNBINDING<br /> device_links_unbind_consumers(oic):<br /> oic--pinctrl link-&gt;status = DL_STATE_SUPPLIER_UNBIND<br /> call device_release_driver_internal(pinctrl)...<br /> device_links_busy(pinctrl):<br /> links-&gt;status = DL_DEV_UNBINDING<br /> device_links_unbind_consumers(pinctrl):<br /> pinctrl--i2c link-&gt;status = DL_STATE_SUPPLIER_UNBIND<br /> call device_release_driver_internal(i2c)...<br /> device_links_busy(i2c): links-&gt;status = DL_DEV_UNBINDING<br /> __device_links_no_driver(i2c)...<br /> pinctrl--i2c link-&gt;status is DL_STATE_SUPPLIER_UNBIND<br /> oic--i2c link-&gt;status is DL_STATE_ACTIVE<br /> oic--i2c link-&gt;supplier-&gt;links.status is DL_DEV_UNBINDING<br /> <br /> The warning is triggered by the i2c removal because the OIC (supplier)<br /> links status is not DL_DEV_DRIVER_BOUND. Its links status is indeed set<br /> to DL_DEV_UNBINDING.<br /> <br /> It is perfectly legit to have the links status set to DL_DEV_UNBINDING<br /> in that case. Indeed we had started to unbind the OIC which triggered<br /> the consumer unbinding and didn&amp;#39;t finish yet when the i2c is unbound.<br /> <br /> Avoid the warning when the supplier links status is set to<br /> DL_DEV_UNBINDING and thus support this removal sequence without any<br /> warnings.