CVE-2026-80654: soc: xilinx: Shutdown and free rx mailbox channel
In the Linux kernel, the following vulnerability has been resolved:
soc: xilinx: Shutdown and free rx mailbox channel
A mbox rx channel is requested using mboxrequestchannelbyname() in probe. In remove callback, the rx mailbox channel is cleaned up when the rxchan is NULL due to incorrect condition check. The mailbox channel is not shutdown and it can receive messages even after the device removal. This leads to use after free. Also the channel resources are not freed. Fix this by checking the rxchan correctly.
Affected Software
Event History
Frequently Asked Questions
When does the use-after-free condition occur?
It occurs when the affected device is removed after its RX mailbox channel was requested during probe. The incorrect remove-path condition leaves a valid RX channel active, allowing it to receive messages after associated device resources have been freed.
What must be true for a system to be exposed?
The affected Xilinx SoC driver must have successfully requested an RX mailbox channel. Exposure depends on device removal while that channel remains active; the description does not identify a remote trigger or any required attacker privileges.
What is the impact besides use after free?
The RX mailbox channel is not shut down, so it may continue receiving messages after device removal and access freed memory. Its channel resources are also not released.
How can the issue be addressed?
Apply the Linux kernel fix that corrects the RX-channel condition in the remove callback. The corrected cleanup shuts down and frees the RX mailbox channel when it is present.