CVE-2026-92476: crypto: keembay - Initialize completion before requesting IRQ
In the Linux kernel, the following vulnerability has been resolved:
crypto: keembay - Initialize completion before requesting IRQ
kmbocsaesprobe() requests the device IRQ before initializing irqcompletion. Once the handler is registered it can run immediately, and ocsaesirqhandler() unconditionally calls complete(). An interrupt in this window would therefore use an uninitialized completion.
Initialize the completion before requesting the IRQ, as the sibling OCS HCU and ECC drivers already do.
Affected Software
Event History
Frequently Asked Questions
When can the issue be triggered?
It can occur during kmb_ocs_aes_probe() if the device interrupt fires after the IRQ handler is registered but before irq_completion is initialized. The handler then calls complete() on an uninitialized completion.
What does the corrective change need to do?
Initialize irq_completion before requesting the device IRQ, so that the interrupt handler cannot run against an uninitialized completion.