CVE-2026-64100

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/msm: Fix shrinker deadlock<br /> <br /> With PROVE_LOCKING on an Snapdragon X1 and VM reclaim pressure, we see:<br /> <br /> ======================================================<br /> WARNING: possible circular locking dependency detected<br /> 7.0.0-debug+ #43 Tainted: G W<br /> ------------------------------------------------------<br /> kswapd0/82 is trying to acquire lock:<br /> ffff800080ec3870 (reservation_ww_class_acquire){+.+.}-{0:0}, at: msm_gem_shrinker_scan+0x17c/0x400 [msm]<br /> <br /> but task is already holding lock:<br /> ffffc31709b263b8 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x88/0x988<br /> <br /> which lock already depends on the new lock.<br /> <br /> the existing dependency chain (in reverse order) is:<br /> <br /> -&gt; #2 (fs_reclaim){+.+.}-{0:0}:<br /> __lock_acquire+0x4d0/0xad0<br /> lock_acquire.part.0+0xc4/0x248<br /> lock_acquire+0x8c/0x248<br /> fs_reclaim_acquire+0xd0/0xf0<br /> dma_resv_lockdep+0x224/0x348<br /> do_one_initcall+0x84/0x5d0<br /> do_initcalls+0x194/0x1d8<br /> kernel_init_freeable+0x128/0x180<br /> kernel_init+0x2c/0x160<br /> ret_from_fork+0x10/0x20<br /> <br /> -&gt; #1 (reservation_ww_class_mutex){+.+.}-{4:4}:<br /> __lock_acquire+0x4d0/0xad0<br /> lock_acquire.part.0+0xc4/0x248<br /> lock_acquire+0x8c/0x248<br /> dma_resv_lockdep+0x1a8/0x348<br /> do_one_initcall+0x84/0x5d0<br /> do_initcalls+0x194/0x1d8<br /> kernel_init_freeable+0x128/0x180<br /> kernel_init+0x2c/0x160<br /> ret_from_fork+0x10/0x20<br /> <br /> -&gt; #0 (reservation_ww_class_acquire){+.+.}-{0:0}:<br /> check_prev_add+0x114/0x790<br /> validate_chain+0x594/0x6f0<br /> __lock_acquire+0x4d0/0xad0<br /> lock_acquire.part.0+0xc4/0x248<br /> lock_acquire+0x8c/0x248<br /> drm_gem_lru_scan+0x1ac/0x440<br /> msm_gem_shrinker_scan+0x17c/0x400 [msm]<br /> do_shrink_slab+0x150/0x4a0<br /> shrink_slab+0x144/0x460<br /> shrink_one+0x9c/0x1b0<br /> shrink_many+0x27c/0x5c0<br /> shrink_node+0x344/0x550<br /> balance_pgdat+0x2c0/0x988<br /> kswapd+0x11c/0x318<br /> kthread+0x10c/0x128<br /> ret_from_fork+0x10/0x20<br /> <br /> other info that might help us debug this:<br /> Chain exists of:<br /> reservation_ww_class_acquire --&gt; reservation_ww_class_mutex --&gt; fs_reclaim<br /> Possible unsafe locking scenario:<br /> CPU0 CPU1<br /> ---- ----<br /> lock(fs_reclaim);<br /> lock(reservation_ww_class_mutex);<br /> lock(fs_reclaim);<br /> lock(reservation_ww_class_acquire);<br /> <br /> *** DEADLOCK ***<br /> 1 lock held by kswapd0/82:<br /> #0: ffffc31709b263b8 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x88/0x988<br /> <br /> stack backtrace:<br /> CPU: 4 UID: 0 PID: 82 Comm: kswapd0 Tainted: G W 7.0.0-debug+ #43 PREEMPT(full)<br /> Tainted: [W]=WARN<br /> Hardware name: LENOVO 21BX0016US/21BX0016US, BIOS N3HET94W (1.66 ) 09/15/2025<br /> Call trace:<br /> show_stack+0x20/0x40 (C)<br /> dump_stack_lvl+0x9c/0xd0<br /> dump_stack+0x18/0x30<br /> print_circular_bug+0x114/0x120<br /> check_noncircular+0x178/0x198<br /> check_prev_add+0x114/0x790<br /> validate_chain+0x594/0x6f0<br /> __lock_acquire+0x4d0/0xad0<br /> lock_acquire.part.0+0xc4/0x248<br /> lock_acquire+0x8c/0x248<br /> drm_gem_lru_scan+0x1ac/0x440<br /> msm_gem_shrinker_scan+0x17c/0x400 [msm]<br /> do_shrink_slab+0x150/0x4a0<br /> shrink_slab+0x144/0x460<br /> shrink_one+0x9c/0x1b0<br /> shrink_many+0x27c/0x5c0<br /> shrink_node+0x344/0x550<br /> balance_pgdat+0x2c0/0x988<br /> kswapd+0x11c/0x318<br /> kthread+0x10c/0x128<br /> ret_from_fork+0x10/0x20<br /> <br /> kswapd0 holding fs_reclaim calls the MSM shrinker, which calls<br /> dma_resv_lock. This in turn acquires fs_reclaim.<br /> <br /> Fix this deadlock by using dma_resv_trylock() instead, dropping the<br /> subsequently unused passed wait-wound lock &amp;#39;ticket&amp;#39;.<br /> <br /> Patchwork: https://patchwork.freedesktop.org/patch/723564/<br /> [rob: fixup compile errors, replace lockdep splat with somethin<br /> ---truncated---