CVE-2026-93052: misc: bcm-vk: Use acquire/release for msgq_inited
In the Linux kernel, the following vulnerability has been resolved:
misc: bcm-vk: Use acquire/release for msgqinited
bcmvksyncmsgq() fills the message queue information and then sets msgqinited. Readers call bcmvkdrvaccessok() before accessing the message queues and their cached queue information.
atomicset()/atomicread() do not order those accesses. A reader can see msgqinited set while still seeing stale queue information. Use release when publishing the initialized queues and acquire when checking the gate.
Keep the clear in bcmvkblkdrvaccess() as atomicset(). It closes the gate and does not publish queue state to readers.
Event History
Frequently Asked Questions
What runtime condition is required for the issue to occur?
A reader must check access concurrently with message-queue initialization. It can observe the initialization gate as set while still observing stale cached message-queue information.
Which access path relies on the initialization gate?
Readers call bcm_vk_drv_access_ok() before accessing the message queues and their cached queue information. The gate is published by bcm_vk_sync_msgq() after it fills the queue information.
What change addresses the ordering problem?
The initialized queue state must be published with release semantics, and readers must check the gate with acquire semantics. Clearing the gate in bcm_vk_blk_drv_access() remains an unordered atomic set because it closes access rather than publishing queue state.