CVE-2026-80822 Overview
CVE-2026-80822 is a null pointer dereference vulnerability in the Linux kernel's Microchip Inter-Processor Communication (IPC) mailbox driver. The flaw resides in the mchp_ipc_get_cluster_aggr_irq() function within mailbox: mchp-ipc-sbi. The function calls devm_kasprintf() to allocate and format a string but does not verify the return value before use. When allocation fails under memory pressure, the resulting null pointer dereference triggers a kernel oops.
The upstream fix adds an explicit null check and returns -ENOMEM when devm_kasprintf() fails. This vulnerability affects local systems where the driver is loaded on supported Microchip hardware.
Critical Impact
A failed memory allocation inside the Microchip IPC mailbox driver can dereference a null pointer, causing a kernel crash and local denial of service.
Affected Products
- Linux kernel versions including the mchp-ipc-sbi mailbox driver prior to the fix commits
- Microchip PolarFire SoC platforms using the IPC mailbox subsystem
- Downstream Linux distributions that ship the affected mailbox driver
Discovery Timeline
- 2026-09-04 - CVE-2026-80822 published to NVD
- 2026-09-07 - Last updated in NVD database
Technical Details for CVE-2026-80822
Vulnerability Analysis
The defect exists in the Microchip IPC Supervisor Binary Interface (SBI) mailbox driver. The function mchp_ipc_get_cluster_aggr_irq() uses devm_kasprintf() to dynamically construct a string used for interrupt name registration. devm_kasprintf() returns NULL when the kernel memory allocator cannot satisfy the request.
Without a null check, the returned pointer is passed to downstream functions expecting a valid string. Dereferencing this null pointer inside kernel context produces an oops, terminating the calling thread and leaving driver state inconsistent. Depending on kernel configuration, the fault may cascade into broader system instability.
Root Cause
The root cause is missing return-value validation for a memory allocation helper. devm_kasprintf() is a resource-managed variant of kasprintf() and can fail like any other kernel allocator. The affected code path assumed success and used the pointer without validation, matching the pattern classified as a null pointer dereference.
Attack Vector
Exploitation requires local presence on a system running the affected driver on Microchip hardware. An attacker or a triggering workload must induce allocation failure during driver probe or interrupt setup. The realistic impact is a kernel crash rather than code execution or privilege escalation. Remote exploitation is not applicable because the affected code path is exercised through hardware initialization rather than network input.
No verified proof-of-concept code is published. The vulnerability is documented through the upstream kernel commits 364edaed, b233e783, b37c4d0a, and df5c9816.
Detection Methods for CVE-2026-80822
Indicators of Compromise
- Kernel oops entries in dmesg or journalctl -k referencing mchp_ipc_get_cluster_aggr_irq or the mchp-ipc-sbi module
- Unexpected reboots or driver initialization failures on Microchip PolarFire SoC platforms
- Allocation failure warnings from devm_kasprintf preceding the crash trace
Detection Strategies
- Inventory Linux hosts and identify systems running kernel builds that include the mchp-ipc-sbi mailbox driver without the fix commits
- Compare running kernel versions against distribution advisories referencing commits 364edaed, b233e783, b37c4d0a, and df5c9816
- Correlate kernel crash telemetry with driver load events using centralized log analytics
Monitoring Recommendations
- Forward kernel ring buffer output and crash dumps to a centralized logging platform for anomaly review
- Alert on repeated mailbox subsystem errors or interrupt registration failures
- Track patch compliance for embedded and edge Linux devices using Microchip SoCs
How to Mitigate CVE-2026-80822
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 364edaed, b233e783, b37c4d0a, and df5c9816
- Update to a distribution kernel that incorporates the null-check fix for mchp_ipc_get_cluster_aggr_irq()
- Prioritize patching on Microchip PolarFire SoC deployments where the mchp-ipc-sbi driver is loaded
Patch Information
The fix adds a null check on the pointer returned by devm_kasprintf() inside mchp_ipc_get_cluster_aggr_irq() and returns -ENOMEM when the allocation fails. Patches are available in the mainline and stable Linux trees. See Kernel Commit 364edaef, Kernel Commit b233e783, Kernel Commit b37c4d0a, and Kernel Commit df5c9816.
Workarounds
- Unload or blacklist the mchp-ipc-sbi module on systems that do not require Microchip IPC mailbox functionality until patches are applied
- Restrict physical and administrative access to affected embedded devices to limit local triggering conditions
- Monitor memory pressure on affected hosts to reduce the likelihood of allocation failures in driver initialization paths
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
