Executive brief
A vulnerability in the Linux kernel's networking component could cause a system crash during the boot process or when initializing certain hardware. The issue occurs due to a timing conflict (race condition) in how the system handles data buffers for Qualcomm IPC Router (QRTR) devices. If triggered, this leads to a 'null pointer dereference,' resulting in a complete system halt or denial of service.
Technical details
A race condition exists in the Linux kernel's net/qrtr/mhi.c due to the MHI 'auto_queue' feature. When enabled for IPCR DL channels, the 'dl_callback' may be invoked before the client driver has finished its probe sequence and initialized its internal structures. This timing issue results in a NULL pointer dereference when the callback attempts to access uninitialized data. The vulnerability is primarily triggered during device probing or boot, specifically reported on Qualcomm X1E80100 CRD machines. The fix involves removing the 'auto_queue' feature for these channels and requiring the QRTR driver to manage RX buffers manually.
Affected products
- Linux Linux Kernel 5.15.63 to 5.16, 5.17 to 6.18.17, 6.19 to 6.19.6
Timeline
- 2025-12-18: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-05-12: advisory: NVD advisory updated with analysis