CVE-2026-80655: soc: xilinx: Fix race condition in event registration
In the Linux kernel, the following vulnerability has been resolved:
soc: xilinx: Fix race condition in event registration
The zynqmppower driver registers handlers for suspend and subsystem restart events using registerevent(). However, the work structures (zynqmppminitsuspendwork and zynqmppminitrestartwork) used by these handlers were allocated and initialized after the registration call.
This created a race window where, if the firmware triggered an event immediately after registration but before allocation, the callback (suspendeventcallback or subsystemrestarteventcallback) would dereference a NULL pointer in workpending(), leading to a crash.
Fix this by allocating and initializing the work structures before registering the events.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
The affected zynqmp_power driver must register its suspend or subsystem-restart event handler, and firmware must trigger the corresponding event immediately after registration but before the driver's work structures have been allocated and initialized. The callback can then dereference a NULL work-structure pointer in work_pending().
What is the practical impact of successful triggering?
Successful triggering causes a kernel crash due to a NULL-pointer dereference in either the suspend-event or subsystem-restart-event callback.
What change resolves the race?
The fix allocates and initializes zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work before calling register_event(), removing the window in which an event callback can run with uninitialized work structures.