CVE-2026-80975: mfd: qnap-mcu: keep the reply buffer alive past a command timeout

In the Linux kernel, the following vulnerability has been resolved:

mfd: qnap-mcu: keep the reply buffer alive past a command timeout

qnapmcuexec() publishes an on-stack buffer to the receive path:

unsigned char rx[QNAPMCURXBUFFERSIZE]; ... reply->data = rx; reply->length = length;

and qnapmcureceivebuf() writes into it from the serdev receive path, which runs out of flushtoldisc() and is not serialized against qnapmcuexec() at all. buslock cannot cover it, because qnapmcuexec() holds that mutex across waitforcompletiontimeout().

On a timeout qnapmcuexec() returns with reply->data still pointing at its own frame. A reply that arrives late, or an unsolicited message from the MCU, is then written into a stack frame that has been left, corrupting whatever runs next on that stack. The same applies when qnapmcuwrite() fails, since that path returns without touching the reply state either.

Move the receive buffer into struct qnapmcu. It is 37 bytes and the structure is devmkzalloc()ed, so it lives as long as the driver, and a late write lands in memory that is still valid and is reinitialized by the next command. buslock keeps commands from sharing it.

This deliberately does not clear reply->data or reply->length on the timeout path. Doing so races with qnapmcureceivebuf(), which reads both after its

if (!reply->length) return size;

check: clearing reply->data gives a NULL dereference, and clearing reply->length alone removes the reply->received == reply->length exit condition, so the copy loop runs until the uart chunk is consumed and overruns the buffer. Leaving both set keeps the write bounded by reply->length, which qnapmcuexec() has already checked against sizeof(mcu->rx).