Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report
Check your stack
CVE-2026-97479

driver core: Avoid warning when removing a device while its supplier is unbinding

Products / packages Linux

Published

Share

Severity and exploitation

Not in CISA KEVNo CVSS score

KEV coverage does not rule out exploitation.

KEV checked 14/11/2026, 21:25:33 UTC

Severity

unknown

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Not established by this record

Missing evidence does not mean no public exploit exists.

Remediation

Fix status not established

No structured fix or guidance is available here. Check the latest publisher advisory.

What this means

A warning occurs in the Linux kernel when removing a device while its supplier is unbinding. The issue affects Linux kernel versions 5.6.19, 5.7.3, and 5.8. The warning is triggered when a consumer is removed because the links status of its supplier is not DL_DEV_DRIVER_BOUND.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Attack conditions

No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

Linux · Linux

Linux

9 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

8c3e315d4296421cd26b3300ee0ac117f0877f20 → before 3d13785eabc3871bde179f3f17a2b2bef064864a

git versions

8c3e315d4296421cd26b3300ee0ac117f0877f20 → before d5eb39d6178ca88db706c7b82dcd19a77f30aa9e

git versions

8c3e315d4296421cd26b3300ee0ac117f0877f20 → before da22e4bce2a8cbed32dcda407b7d06cb5feec8e3

git versions

8c3e315d4296421cd26b3300ee0ac117f0877f20 → before 73ea4ec0ec46d12558a61842b474e7dd63538edc

git versions

8c3e315d4296421cd26b3300ee0ac117f0877f20 → before 36d74f17e03f7e60e1b08fbe16cfad6e69cc3aa9

git versions

2e5c082d3727522a3f30a50582784d24754d14a8

git versions

70154bb515a325c007bcf64971099e1e17f16f28

git versions

5.6.19 → before 5.7

semver versions

5.7.3 → before 5.8

semver versions

unaffected

unknown

Other versions: unaffected

Linux · Linux

Linux

7 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

5.8

unaffected

0 → before 5.8

semver versions

6.1.191 → through 6.1.*

semver versions

6.6.160 → through 6.6.*

semver versions

6.12.114 → through 6.12.*

semver versions

6.18.53 → through 6.18.*

semver versions

7.2 → through *

original_commit_for_fix versions

unknown

Other versions: affected

Automatic dependency matching is unavailable for this record. Use the product evidence and publisher’s instructions to check your installation.

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

No structured fix or remediation guidance is available here. Check the full source description and vendor’s latest advisory for a patch or workaround; do not assume another version is safe.

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.

Original source description

Read the full publisher description

In the Linux kernel, the following vulnerability has been resolved:

driver core: Avoid warning when removing a device while its supplier is unbinding

During driver removal, the following warning can appear: WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 __device_links_no_driver+0xcc/0xfc ... Call trace: __device_links_no_driver+0xcc/0xfc (P) device_links_driver_cleanup+0xa8/0xf0 device_release_driver_internal+0x208/0x23c device_links_unbind_consumers+0xe0/0x108 device_release_driver_internal+0xec/0x23c device_links_unbind_consumers+0xe0/0x108 device_release_driver_internal+0xec/0x23c device_links_unbind_consumers+0xe0/0x108 device_release_driver_internal+0xec/0x23c driver_detach+0xa0/0x12c bus_remove_driver+0x6c/0xbc driver_unregister+0x30/0x60 pci_unregister_driver+0x20/0x9c lan966x_pci_driver_exit+0x18/0xa90 [lan966x_pci]

This warning is triggered when a consumer is removed because the links status of its supplier is not DL_DEV_DRIVER_BOUND and the link flag DL_FLAG_SYNC_STATE_ONLY is not set.

The topology in terms of consumers/suppliers used was the following (consumer ---> supplier):

  i2c -----------> OIC ----> PCI device
   |                ^
   |                |
   +---> pinctrl ---+

When the PCI device is removed, the OIC (interrupt controller) has to be removed. In order to remove the OIC, pinctrl and i2c need to be removed and to remove pinctrl, i2c need to be removed. The removal order is:

  1. i2c
  2. pinctrl
  3. OIC
  4. PCI device

In details, the removal sequence is the following (with 0000:01:00.0 the PCI device): driver_detach: call device_release_driver_internal(0000:01:00.0)... device_links_busy(0000:01:00.0): links->status = DL_DEV_UNBINDING device_links_unbind_consumers(0000:01:00.0): 0000:01:00.0--oic link->status = DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(oic)... device_links_busy(oic): links->status = DL_DEV_UNBINDING device_links_unbind_consumers(oic): oic--pinctrl link->status = DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(pinctrl)... device_links_busy(pinctrl): links->status = DL_DEV_UNBINDING device_links_unbind_consumers(pinctrl): pinctrl--i2c link->status = DL_STATE_SUPPLIER_UNBIND call device_release_driver_internal(i2c)... device_links_busy(i2c): links->status = DL_DEV_UNBINDING __device_links_no_driver(i2c)... pinctrl--i2c link->status is DL_STATE_SUPPLIER_UNBIND oic--i2c link->status is DL_STATE_ACTIVE oic--i2c link->supplier->links.status is DL_DEV_UNBINDING

The warning is triggered by the i2c removal because the OIC (supplier) links status is not DL_DEV_DRIVER_BOUND. Its links status is indeed set to DL_DEV_UNBINDING.

It is perfectly legit to have the links status set to DL_DEV_UNBINDING in that case. Indeed we had started to unbind the OIC which triggered the consumer unbinding and didn't finish yet when the i2c is unbound.

Avoid the warning when the supplier links status is set to DL_DEV_UNBINDING and thus support this removal sequence without any warnings.

References

5 sources
git.kernel.org/stable/c/3d13785eabc3871bde179f3f17a2b2bef064864a
Source referenceLinux
git.kernel.org/stable/c/d5eb39d6178ca88db706c7b82dcd19a77f30aa9e
Source referenceLinux
git.kernel.org/stable/c/da22e4bce2a8cbed32dcda407b7d06cb5feec8e3
Source referenceLinux
git.kernel.org/stable/c/73ea4ec0ec46d12558a61842b474e7dd63538edc
Source referenceLinux
git.kernel.org/stable/c/36d74f17e03f7e60e1b08fbe16cfad6e69cc3aa9
Source referenceLinux

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification · not supplied
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-97479

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

Linux · platform conditions

Any condition may hold

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.8

Before: 6.1.191

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.8

Before: 6.6.160

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.8

Before: 6.12.114

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.8

Before: 6.18.53

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.8

Before: 7.2

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.6.19

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 5.7.3

Applicability preview
[
  {
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.8",
            "versionEndExcluding": "6.1.191"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.8",
            "versionEndExcluding": "6.6.160"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.8",
            "versionEndExcluding": "6.12.114"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.8",
            "versionEndExcluding": "6.18.53"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.8",
            "versionEndExcluding": "7.2"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.6.19"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "5.7.3"
          }
        ]
      }
    ]
  }
]
Contributing organizations · 1
Linux

Assigning organization

2026-10-30

Timeline

All times UTC

  1. Advisory published

    Publication date supplied by the source.

  2. Source updated

    Latest modification date supplied by the source.

  3. Last imported by cve.new

    Latest catalog import, not the date we first saw this advisory.

What changed

Follow changes

Large field values are marked as truncated previews. Original source snapshots remain retained.