CVE-2026-53380 Overview
CVE-2026-53380 is a race condition in the Linux kernel's rzv2h-ivc media driver. The rzv2h_ivc_transfer_buffer() function, which runs in a separate workqueue, calls list_del() on the shared buffer queue without holding the protecting spinlock. This creates a window where the buffer list (rzv2h_ivc::buffers.queue) can be concurrently modified, leading to memory corruption. A local authenticated attacker with the ability to trigger the affected code path can compromise kernel confidentiality, integrity, and availability.
Critical Impact
A local low-privileged actor can trigger concurrent list access in the kernel media subsystem, potentially causing memory corruption, kernel panic, or privilege escalation on affected Linux systems.
Affected Products
- Linux kernel builds including the rzv2h-ivc media driver
- Renesas RZ/V2H platform kernels using the IVC (Inter-VLIW Communication) driver
- Stable kernel branches prior to the fixes in commits 72773ff1cdfa and c746522bd326
Discovery Timeline
- 2026-07-19 - CVE-2026-53380 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-53380
Vulnerability Analysis
The defect resides in the Renesas RZ/V2H IVC media driver. The driver maintains a queue of buffers in rzv2h_ivc::buffers.queue, protected by the spinlock rzv2h_ivc::buffers.lock. Producers correctly acquire the lock when enqueueing buffers.
The consumer function rzv2h_ivc_transfer_buffer() executes from a workqueue context. It removes a buffer from the queue using list_del() without holding the spinlock. Because workqueue execution runs concurrently with producer paths, the list can be mutated by another CPU during traversal or deletion.
Concurrent list modification in the kernel corrupts the doubly-linked list pointers. This can lead to use-after-free conditions, dereference of poisoned list pointers, or arbitrary memory writes when subsequent list operations follow corrupted next and prev pointers.
The fix moves the list_del() and the assignment of ivc->buffers.curr into the lock-protected critical section, ensuring atomicity between list membership check, removal, and current-buffer assignment [CWE-362].
Root Cause
The root cause is inconsistent locking discipline. Producers held rzv2h_ivc::buffers.lock when modifying the queue, but the workqueue consumer performed list_del() outside the lock. This violates the invariant that all mutations of a spinlock-protected list must occur under the same lock.
Attack Vector
An attacker requires local access with low privileges on a system exposing the rzv2h-ivc driver. By issuing concurrent operations that enqueue buffers while the workqueue consumer processes them, the attacker races the unlocked list_del(). Successful races can corrupt kernel heap structures, yielding denial of service or privilege escalation. Attack complexity is low and no user interaction is required.
The vulnerability is described in prose only; no public proof-of-concept is available. See the upstream commits 72773ff1cdfa and c746522bd326 for the corrective patches.
Detection Methods for CVE-2026-53380
Indicators of Compromise
- Kernel oops or panic messages referencing list_del corruption, next->prev mismatches, or poisoned list pointers (LIST_POISON1/LIST_POISON2) originating from the rzv2h_ivc module
- Unexplained crashes in workqueue worker threads processing media buffers on Renesas RZ/V2H hardware
- KASAN reports indicating use-after-free or slab corruption in rzv2h_ivc_transfer_buffer()
Detection Strategies
- Enable CONFIG_DEBUG_LIST and CONFIG_KASAN on test kernels to catch list corruption at the point of occurrence
- Audit installed kernel versions against the fixed commits and flag hosts running vulnerable rzv2h-ivc builds
- Correlate media subsystem crash dumps and dmesg output with local user activity that exercises IVC device nodes
Monitoring Recommendations
- Forward /var/log/kern.log and dmesg output to a centralized log platform and alert on list_del corruption or general protection fault entries referencing rzv2h
- Monitor unexpected reboots and kernel crashes on Renesas RZ/V2H embedded devices
- Track access to IVC character devices under /dev by non-root users
How to Mitigate CVE-2026-53380
Immediate Actions Required
- Apply the upstream Linux kernel patches from commits 72773ff1cdfa and c746522bd326 and rebuild affected kernels
- Restrict local access to systems running the rzv2h-ivc driver until patched
- Tighten permissions on IVC device nodes so only trusted service accounts can open them
Patch Information
The fix relocates the list_del() call inside the section guarded by rzv2h_ivc::buffers.lock and assigns ivc->buffers.curr within the same critical section. Patches are available in the mainline and stable trees via Kernel Git Commit 72773ff1cdfa and Kernel Git Commit c746522bd326. Downstream distributions should backport these commits into supported stable branches.
Workarounds
- Unload the rzv2h-ivc kernel module on systems that do not require the media IVC functionality
- Blacklist the module via /etc/modprobe.d/ to prevent auto-load at boot
- Limit which local users can invoke workloads that queue buffers to the IVC driver
# Blacklist the vulnerable module until the kernel is patched
echo "blacklist rzv2h_ivc" | sudo tee /etc/modprobe.d/blacklist-rzv2h-ivc.conf
sudo rmmod rzv2h_ivc 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
