Race condition in Linux kernel - CVE-2026-80655

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in the zynqmp_power event registration handlers when processing firmware-triggered suspend or subsystem restart events immediately after event registration. A local user can trigger the affected event handling path to cause a denial of service.

The issue can lead to a NULL pointer dereference in work_pending() if the callback runs before the work structures are allocated and initialized.

Affected software

How to mitigate CVE-2026-80655

External References

• https://git.kernel.org/stable/c/d349aa118ff5e4cab88424ce1b16e08edd70f8bb
• https://git.kernel.org/stable/c/fb445935338405110baca8f541a2df3b4cb8d712

Related Security Bulletins

• Race condition in Linux kernel soc xilinx driver