CVE-2026-80655: soc: xilinx: Fix race condition in event registration
In the Linux kernel, the following vulnerability has been resolved:
soc: xilinx: Fix race condition in event registration
The zynqmppower driver registers handlers for suspend and subsystem restart events using registerevent(). However, the work structures (zynqmppminitsuspendwork and zynqmppminitrestartwork) used by these handlers were allocated and initialized after the registration call.
This created a race window where, if the firmware triggered an event immediately after registration but before allocation, the callback (suspendeventcallback or subsystemrestarteventcallback) would dereference a NULL pointer in workpending(), leading to a crash.
Fix this by allocating and initializing the work structures before registering the events.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In the zynqmp_power driver, allocate and initialize zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work before registering suspend and subsystem restart event handlers with register_event().
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
The affected zynqmp_power driver must register its suspend or subsystem-restart event handler, and firmware must trigger the corresponding event immediately after registration but before the driver's work structures have been allocated and initialized. The callback can then dereference a NULL work-structure pointer in work_pending().
What is the practical impact of successful triggering?
Successful triggering causes a kernel crash due to a NULL-pointer dereference in either the suspend-event or subsystem-restart-event callback.
What change resolves the race?
The fix allocates and initializes zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work before calling register_event(), removing the window in which an event callback can run with uninitialized work structures.