CVE-2026-90193: mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler
In the Linux kernel, the following vulnerability has been resolved:
mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler
qcomcpucpmboxirqfn() calls mboxchanreceiveddata() while holding chan->lock. Under PREEMPTRT, spinlockirqsave() is converted to an rtspinlock (rtmutex-based), which tracks ownership and can sleep.
The callback chain triggered by mboxchanreceiveddata() eventually reaches mailboxclearchannel() -> mboxsendmessage() -> addtorbuf(), which attempts to re-acquire the same chan->lock. Since rtmutex detects the re-entrant lock attempt by the same owner, the thread blocks waiting for a lock it already holds, causing a permanent deadlock.
This deadlock manifests as 'irq/N-apsscpucpmbox' stuck in D state with the following call trace: rtspinlock -> mboxsendmessage -> mailboxclearchannel -> scmirxcallback -> mboxchanreceiveddata [<- held chan->lock here]
Fix by saving chan->cl locally and clearing the HW interrupt register inside the lock, then invoking mboxchanreceiveddata() after releasing the lock. This preserves the mutual exclusion for chan->cl access while avoiding the lock re-entrancy that causes the PREEMPTRT deadlock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mailbox: qcom-cpucpto a version that resolves this vulnerability.Patch mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler - Compensating control
Ensure the PREEMPT_RT deadlock condition is mitigated for the affected IRQ path by applying the upstream change that saves chan->cl locally and clears the HW interrupt register (so the IRQ handler does not re-enter mbox_send_message/lock paths through mbox_chan_received_data()).