CVE-2026-97479

Red Hat rates this Linux kernel driver core flaw as LOW severity for the affected Red Hat Enterprise Linux streams (kernel and kernel-rt), Red Hat In-Vehicle OS, and the RHEL CoreOS images used by OpenShift Container Platform. When a device is removed while one of its supplier devices is still in the process of unbinding, the driver core can emit an unexpected kernel warning in __device_links_no_driver() because the supplier's device-link state is legitimately set to DL_DEV_UNBINDING during a valid nested consumer/supplier removal sequence. A local privileged user with the ability to unbind device drivers or remove devices could trigger this warning under specific multi-tier consumer/supplier device-link conditions, causing a denial of service only on systems configured to treat kernel warnings as fatal (panic_on_warn); on default configurations the issue results in a warning message with no further consequence. Red Hat Enterprise Linux 7 is not affected because the code that emits this warning is not present in that stream, and Red Hat Enterprise Linux 6 is out of support scope for this flaw. Fixes for the affected streams are currently deferred given the low severity of the issue; the residual risk is limited to an unexpected kernel warning, or a system crash only where panic_on_warn is enabled, reachable solely through privileged local driver-removal operations on hardware with the required consumer/supplier topology. The LOW Red Hat severity is lower than the moderate CVSS:3.1 base score of 5.5 would suggest because the underlying condition is a diagnostic false positive with no confidentiality or integrity impact, exploitation requires local administrative privileges and an uncommon hardware topology, and a crash occurs only in non-default panic_on_warn configurations.