CVE-2026-80655: Linux Kernel Race Condition Vulnerability

CVE-2026-80655 Overview

CVE-2026-80655 is a race condition vulnerability in the Linux kernel's Xilinx Zynqmp power driver (soc: xilinx). The zynqmp_power driver registered handlers for suspend and subsystem restart events using register_event() before allocating the associated work structures. If firmware triggered an event between registration and allocation, the callback dereferenced a NULL pointer in work_pending(), causing a kernel crash. The fix reorders initialization so that zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work are allocated before event handlers are registered.

Critical Impact

Firmware-triggered events during the narrow initialization window can dereference a NULL pointer in kernel space, resulting in a denial-of-service crash on affected Xilinx Zynqmp SoC platforms.

Affected Products

• Linux kernel builds including the zynqmp_power driver under soc: xilinx
• Xilinx Zynqmp SoC platforms relying on suspend and subsystem restart event handling
• Downstream distributions shipping the unpatched Zynqmp power driver

Discovery Timeline

• 2026-08-28 - CVE-2026-80655 published to NVD
• 2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80655

Vulnerability Analysis

The zynqmp_power driver in soc: xilinx manages platform power management events including suspend and subsystem restart. It uses register_event() to register suspend_event_callback and subsystem_restart_event_callback with the firmware event mechanism. The driver, prior to the fix, invoked register_event() before it allocated and initialized the zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work work structures. This ordering produced a race window during driver probe.

During this window, the firmware can legitimately deliver an event. When the callback fires, it calls work_pending() against a work structure that has not yet been allocated. The dereference of an uninitialized pointer triggers a NULL pointer dereference in kernel context, producing an oops and typically halting the affected kernel path. The vulnerability is a classic ordering flaw in initialization logic rather than a memory-safety bug in the traditional sense.

Root Cause

The root cause is incorrect initialization ordering in the Zynqmp power driver probe path. Event registration made callbacks reachable before the resources those callbacks required existed. Any code path that assumes an allocation completes before external triggers can arrive is subject to this class of race.

Attack Vector

Exploitation requires the firmware to emit a suspend or subsystem restart event during the exact interval between register_event() and work-structure allocation. The window is small and depends on system timing, firmware behavior, and probe scheduling. The observable outcome is a kernel crash rather than code execution or privilege escalation. No verified public exploit or proof of concept is available for this issue. See the Kernel Git Commit Fix and the Kernel Git Commit Update for the corrected initialization order.

No verified exploit code is publicly available. The vulnerability is documented in the upstream kernel commits linked above.

Detection Methods for CVE-2026-80655

Indicators of Compromise

• Kernel oops or panic messages referencing work_pending, suspend_event_callback, or subsystem_restart_event_callback in dmesg or system journal output.
• Unexpected reboots or hangs on Xilinx Zynqmp SoC platforms during early boot or driver probe.
• Stack traces implicating the zynqmp_power driver during firmware event delivery.

Detection Strategies

• Inventory Linux kernel versions across Zynqmp-based devices and compare against the fixed commits fb445935 and d349aa11.
• Collect kernel crash telemetry and search for NULL pointer dereferences originating in the soc/xilinx/zynqmp_power code path.
• Correlate firmware event logs with driver probe timestamps to identify racy initialization sequences.

Monitoring Recommendations

• Forward dmesg, journalctl, and kdump artifacts from embedded Zynqmp fleets to a centralized log platform for kernel-oops pattern matching.
• Alert on repeated kernel panics on the same device class, which can indicate an unpatched driver rather than isolated hardware faults.
• Track upstream stable-tree backports of the fix to confirm downstream vendor kernels have absorbed the change.

How to Mitigate CVE-2026-80655

Immediate Actions Required

• Apply the upstream kernel fix from commit fb445935338405110baca8f541a2df3b4cb8d712 to any Zynqmp-based Linux build.
• Rebuild and redeploy firmware images for affected Xilinx Zynqmp devices after integrating the corrected driver.
• Prioritize patching devices that experience frequent suspend or subsystem restart events during boot.

Patch Information

The fix reorders driver initialization so that zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work are allocated and initialized before register_event() is called. This eliminates the window where a callback could execute against an unallocated work structure. Refer to the Kernel Git Commit Fix and the Kernel Git Commit Update for the exact source changes and stable-tree references.

Workarounds

• No supported runtime workaround exists; the fix requires a kernel source patch and rebuild.
• Where patching is delayed, avoid exposing devices to firmware conditions that emit suspend or subsystem restart events during early boot.
• Restrict physical and management-plane access to affected Zynqmp devices to reduce operational impact of unexpected crashes.

# Verify kernel commit is present in the running source tree
git -C /path/to/linux log --oneline | grep -E 'fb44593533|d349aa118ff5'