CVE-2026-80975 Overview
CVE-2026-80975 is a memory corruption vulnerability in the Linux kernel's qnap-mcu multi-function device (MFD) driver. The flaw resides in qnap_mcu_exec(), which publishes an on-stack receive buffer to the serdev receive path. When a command times out or qnap_mcu_write() fails, the function returns while reply->data still points at the caller's stack frame. A late reply or unsolicited MCU message then writes into memory that has already been reclaimed, corrupting whatever executes next on that stack.
Critical Impact
A late or unsolicited response from the QNAP microcontroller can overwrite an active kernel stack frame, enabling local privilege escalation or kernel memory corruption on affected QNAP NAS platforms.
Affected Products
- Linux kernel builds that include the mfd/qnap-mcu driver
- QNAP NAS hardware relying on the QNAP microcontroller serdev interface
- Distributions shipping the vulnerable driver prior to the referenced stable patch commits
Discovery Timeline
- 2026-09-11 - CVE-2026-80975 published to the National Vulnerability Database
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-80975
Vulnerability Analysis
The qnap_mcu_exec() function declares a receive buffer on the stack: unsigned char rx[QNAP_MCU_RX_BUFFER_SIZE]. It then assigns reply->data = rx and reply->length = length before calling wait_for_completion_timeout(). The bus_lock mutex is held across the wait, but it does not synchronize with qnap_mcu_receive_buf(), which runs from flush_to_ldisc() in the serdev receive path.
When the wait times out, or when qnap_mcu_write() fails, qnap_mcu_exec() returns without clearing reply->data or reply->length. The stack frame containing rx is reused by subsequent kernel code. If the MCU later delivers the delayed reply, or emits an unsolicited message, qnap_mcu_receive_buf() writes into that reclaimed stack memory, producing an out-of-bounds write against an unrelated frame.
Root Cause
The root cause is a lifetime mismatch between a stack-allocated buffer and an asynchronous receive callback that retains a pointer to it. The receive path and the command path are not serialized, so bus_lock cannot bound the buffer's exposure. The fix relocates the receive buffer into struct qnap_mcu, which is allocated with devm_kzalloc() and lives for the driver's lifetime. Late writes then land in memory that remains valid and is reinitialized by the next command.
Attack Vector
Exploitation requires local access with the ability to interact with the affected NAS driver stack, and depends on race timing between command timeouts and MCU responses. A malicious or compromised low-privileged process that can influence MCU command execution, combined with a delayed or attacker-influenced MCU reply, can corrupt arbitrary kernel stack contents. Successful corruption of a return address or function pointer on the reused stack frame can lead to kernel-mode code execution or privilege escalation.
See the upstream fixes for the corrected buffer lifetime handling: Kernel Patch Commit 0b6680e, Kernel Patch Commit 4750474, and Kernel Patch Commit 8391ee0.
Detection Methods for CVE-2026-80975
Indicators of Compromise
- Unexplained kernel oopses or panics referencing qnap_mcu_receive_buf or qnap_mcu_exec in the call stack
- Stack corruption warnings from KASAN, stack canary failures, or Oops: stack-out-of-bounds events on QNAP hardware
- Repeated MCU command timeouts logged by the qnap-mcu driver followed by anomalous kernel behavior
Detection Strategies
- Enable KASAN and stack protector instrumentation on test kernels to surface the out-of-bounds write from late MCU replies
- Correlate dmesg entries showing MCU timeouts with subsequent process crashes or kernel taints
- Inventory running kernels across QNAP-based systems and flag versions predating the referenced stable patches
Monitoring Recommendations
- Forward kernel logs from NAS and embedded Linux fleets to a central log store and alert on qnap-mcu timeout patterns
- Monitor for unexpected privilege transitions or new root-owned processes on affected hosts following MCU errors
- Track kernel package versions through configuration management to confirm patch application over time
How to Mitigate CVE-2026-80975
Immediate Actions Required
- Update the Linux kernel to a stable release containing the referenced qnap-mcu fix commits
- Restrict local access to affected NAS systems and enforce least-privilege for shell and management accounts
- Audit third-party kernel modules and vendor images to confirm they incorporate the upstream patch
Patch Information
The fix moves the receive buffer from the stack into struct qnap_mcu, where it is allocated via devm_kzalloc() and persists for the driver's lifetime. The patch deliberately leaves reply->data and reply->length set on the timeout path to avoid a race with qnap_mcu_receive_buf(). Apply the changes from Kernel Patch Commit 0b6680e, Kernel Patch Commit 4750474, or Kernel Patch Commit 8391ee0 depending on the stable branch in use.
Workarounds
- Unload or blacklist the qnap-mcu module on systems where MCU functionality is not required
- Reduce local attack surface by limiting SSH access and disabling unused services on QNAP-derived Linux systems
- Enable stack protection features such as CONFIG_STACKPROTECTOR_STRONG and CONFIG_VMAP_STACK to increase exploitation difficulty until patching
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
