CVE-2026-80654: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80654 Overview

CVE-2026-80654 is a use-after-free vulnerability in the Linux kernel's Xilinx SoC driver. The flaw resides in the receive (rx) mailbox channel cleanup logic within the driver's remove callback. An incorrect condition check on the rx_chan pointer prevents the mailbox channel from being properly shut down and freed during device removal. As a result, the channel can continue receiving messages after the device has been removed, leading to use-after-free conditions and leaked channel resources. The Linux kernel maintainers resolved the issue by correcting the rx_chan pointer validation so the channel is correctly shut down and its resources released.

Critical Impact
Improper cleanup of the Xilinx SoC rx mailbox channel produces a use-after-free that can be triggered by inbound mailbox messages after device removal, risking kernel memory corruption.

Affected Products

Linux kernel builds containing the Xilinx SoC driver (drivers/soc/xilinx/)
Platforms using Xilinx Zynq/ZynqMP/Versal SoCs with the mailbox rx channel
Distribution kernels prior to backporting commits a83e77d, b0f748c, b5d2240, and fdee7c6

Discovery Timeline

2026-08-28 - CVE-2026-80654 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80654

Vulnerability Analysis

The Xilinx SoC driver requests a mailbox rx channel during probe using mbox_request_channel_byname(). This channel is used to receive asynchronous messages from firmware or a companion processor. During device removal, the driver's remove callback is responsible for shutting down the channel and releasing the associated resources.

The defect lies in the cleanup logic. The remove path only performs channel teardown when rx_chan is NULL, which is the inverse of the correct behavior. When a valid channel pointer exists, cleanup is skipped entirely. The mailbox subsystem then continues to route incoming messages to callbacks associated with a device that no longer exists, dereferencing freed driver state.

This is classified as a Use-After-Free (UAF) issue in kernel-mode code. Because rx mailbox messages arrive asynchronously from hardware or firmware, the window for triggering the freed callback remains open indefinitely after removal.

Root Cause

The root cause is an inverted NULL check on the rx_chan pointer inside the driver remove callback. The condition should trigger mbox_free_channel() and shutdown when rx_chan is non-NULL, but the original code only proceeded when it was NULL, leaving live channels attached to a torn-down driver.

Attack Vector

Triggering the vulnerability requires the driver to be unbound or the device removed while the mailbox producer continues to emit messages. In practice this can occur during module unload, hot-unplug, error recovery, or suspend/resume paths. Because the vulnerable path lives in kernel-mode SoC driver code, successful exploitation would require local access with permissions to unbind the driver, and any downstream memory corruption would occur in kernel context.

No verified proof-of-concept code is available. Technical details are documented in the upstream commits referenced below.

Detection Methods for CVE-2026-80654

Indicators of Compromise

Kernel oops or general protection fault traces referencing Xilinx SoC mailbox symbols after driver unbind or module unload.
KASAN reports flagging use-after-free reads or writes originating from mailbox rx callback paths.
Unexpected kernel panics correlated with rmmod, device unbind via sysfs, or hot-unplug events on Xilinx platforms.

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface UAF conditions in the Xilinx mailbox teardown path.
Compare running kernel commit hashes against the fix commits (a83e77d, b0f748c, b5d2240, fdee7c6) using package inventory tooling.
Audit dmesg for mailbox-related warnings around driver bind and unbind lifecycle events.

Monitoring Recommendations

Ingest kernel logs into a centralized log platform and alert on oops, BUG, or KASAN entries referencing xilinx or mbox symbols.
Track kernel package versions on Xilinx SoC fleet devices to confirm the fix commits are present.
Monitor for repeated module load/unload cycles on production Xilinx hardware, which increases exposure to the buggy teardown path.

How to Mitigate CVE-2026-80654

Immediate Actions Required

Update affected Linux kernels to a version that includes commits a83e77d, b0f748c, b5d2240, or fdee7c6.
Restrict access to driver unbind and module unload operations to privileged administrators only.
Inventory Xilinx SoC deployments and prioritize patching devices that experience frequent driver rebind cycles.

Patch Information

The fix corrects the rx_chan validation so the mailbox channel is shut down and freed on device removal. Upstream stable branches carry the change in commits a83e77d, b0f748c, b5d2240, and fdee7c6. Consumers should apply the appropriate backport for their stable series.

Workarounds

Avoid unbinding or unloading the Xilinx SoC driver on production systems until the patched kernel is deployed.
Where feasible, blacklist module unload via modprobe configuration to prevent triggering the flawed remove path.
Limit local shell access on affected devices to reduce the ability to invoke driver removal.

bash

# Verify installed kernel includes one of the fix commits
uname -r
git -C /path/to/linux log --oneline | grep -E "a83e77d|b0f748c|b5d2240|fdee7c6"

# Prevent inadvertent driver unload on affected fleets
echo "blacklist xilinx_event_manager" | sudo tee /etc/modprobe.d/xilinx-mbox.conf