CVE-2026-74331

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

firmware_loader: Fix recursive lock in device_cache_fw_images()

A recursive locking deadlock can occur in the firmware loader's power

management notification handler.

During system suspend or hibernation preparation, fw_pm_notify() calls

device_cache_fw_images(). This function acquires fw_lock to set the

firmware cache state to FW_LOADER_START_CACHE and then iterates over all

devices using dpm_for_each_dev() while still holding the lock.

For each device, dev_cache_fw_image() schedules asynchronous work to cache

the firmware. If memory allocation for the async work entry fails (e.g., in

out-of-memory conditions), async_schedule_node_domain() falls back to

executing the work function synchronously in the current thread.

The synchronous execution path (__async_dev_cache_fw_image() ->

cache_firmware() -> request_firmware() -> assign_fw()) attempts to acquire

fw_lock again. Since the current thread already holds fw_loc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References