{"id":"AZL-103595","summary":"CVE-2026-93815 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: au1000: move free_irq out of the close-time spinlocked section\n\nau1000_close() calls free_irq() while aup-\u003elock is still held with\nspin_lock_irqsave(). free_irq() can sleep because it takes the IRQ\ndescriptor request mutex, so it does not belong inside the close-time\nspinlocked section.\n\nThis was found by our static analysis tool and then confirmed by manual\nreview of the in-tree au1000_close() .ndo_stop path. The reviewed path\nkeeps aup-\u003elock held across the MAC reset, queue stop and\nfree_irq(dev-\u003eirq, dev).\n\nA directed runtime validation kept that ndo_stop carrier and the same\nfree_irq(dev-\u003eirq, dev) operation under the driver lock. Lockdep reported\n\"BUG: sleeping function called from invalid context\" and \"Invalid wait\ncontext\" while free_irq() was taking desc-\u003erequest_mutex, with\nau1000_close() and free_irq() on the stack.\n\nDrop aup-\u003elock before freeing the IRQ. The protected close-time work still\nstops the device and queue before IRQ teardown, but the sleepable IRQ core\npath now runs outside the spinlocked section.","modified":"2026-09-25T14:15:43.060222084Z","published":"2026-09-24T17:17:15Z","upstream":["CVE-2026-93815"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93815"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103595.json"}}],"schema_version":"1.9.0"}