From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D23EF3D34BC for ; Fri, 28 Aug 2026 06:51:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899903; cv=none; b=DrzdpB8gLsnumMlFGr3l7si5JmThua/r0zlLrSRu8hEe9VH2Wv1UOD4icHWgoq7vF7gDtUv0ce++8cljwEb1mBN5M6plMQ8LlVrldaCHomIfFHSOrfPG7Yjlm06a5V7LsAmEhZJe65UU+XSEGZeEijQ/JBJFBf5Wd6+ixxP5WSY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787899903; c=relaxed/simple; bh=Qf0ANk25Msl3ahrMuN0+vBCMifdtL30YuPs6qkK2a7U=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=cRj/get633kKKoeWRkSCP1jhW47p8OauA6ZzsbbX4OJdlibrCJIMhSF6IilI2O5DnKvZDdwyItleCQad3vVR97qK1IDM7BaOKD+5h8qNfhywBeXjHK1QalkD91V4ObqhLY1tSmP8nyzk4tHz0bvp5/88RGKI/9uaAsVnUwCLboE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XSM45EpT; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="XSM45EpT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 163E41F000E9; Fri, 28 Aug 2026 06:51:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787899901; bh=1VU50r13ky03dDlJWH1Bz3y7JFtBQhVNvqk9O1wb/60=; h=From:To:Cc:Subject:Date:Reply-To; b=XSM45EpTaQfv8FNa2+DV76YVqyAcIXrC3sCgqKFWCU6TXlo7rGjRzTNUcmAZ28dYX B9jkV7id1nV9K/hx0ShdDljKphGvInPBRokXvJSp5TpPUusdRkDp8L3gKZG5zrBnaJ Y3hVNaCDpPK2jzWXGJzoawGwFGQL73lcYkGzrkJA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-80655: soc: xilinx: Fix race condition in event registration Date: Fri, 28 Aug 2026 08:49:32 +0200 Message-ID: <2026082844-CVE-2026-80655-c437@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2423; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=m/Zohqah+i9sdGkk/JWsoIu5p+rg6UPmpTOY+bTHCiw=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkT9X0SX772r1ZLW/Hz9boJ3Py7ZX/dYlcz2uKSEXJZh 6HsqCZzRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzkaRHDPKXFF6ae8XloEHIh 5tmK1Vt1o95c3sSwoF16/tziLwXJhf5rNoeWruRXj9TmAwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Fix race condition in event registration The zynqmp_power driver registers handlers for suspend and subsystem restart events using register_event(). However, the work structures (zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work) used by these handlers were allocated and initialized after the registration call. This created a race window where, if the firmware triggered an event immediately after registration but before allocation, the callback (suspend_event_callback or subsystem_restart_event_callback) would dereference a NULL pointer in work_pending(), leading to a crash. Fix this by allocating and initializing the work structures before registering the events. The Linux kernel CVE team has assigned CVE-2026-80655 to this issue. Affected and fixed versions =========================== Issue introduced in 6.11 with commit fcf544ac64397776a18246eba5a8ca72a47c4405 and fixed in 7.1.5 with commit d349aa118ff5e4cab88424ce1b16e08edd70f8bb Issue introduced in 6.11 with commit fcf544ac64397776a18246eba5a8ca72a47c4405 and fixed in 7.2 with commit fb445935338405110baca8f541a2df3b4cb8d712 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-80655 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/soc/xilinx/zynqmp_power.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/d349aa118ff5e4cab88424ce1b16e08edd70f8bb https://git.kernel.org/stable/c/fb445935338405110baca8f541a2df3b4cb8d712