Executive brief
A vulnerability in the Linux kernel's interrupt handling for SiFive PLIC chips can cause system components to stop responding. When the system attempts to move an active task between processor cores, the interrupt signal can become 'frozen' or stuck. This results in a denial-of-service for affected hardware components, such as serial ports, potentially disrupting system operations or data transfers.
Technical details
A race condition exists in the irqchip/sifive-plic driver where the PLIC (Platform-Level Interrupt Controller) ignores interrupt completion messages if the interrupt is disabled for the target 'hart' (hardware thread). While the driver attempted to mitigate this by checking irqd_irq_disabled(), this check is insufficient because the PLIC enable bit for a specific hart can be zero even if the global interrupt descriptor state is not marked disabled. This occurs when affinity settings are modified while a hart is still processing an interrupt. An attacker with local access could trigger this by rapidly changing IRQ affinity during high interrupt volume (e.g., UART transfers), causing the interrupt to remain permanently uncompleted and 'frozen'. The fix replaces the software state check with a direct read of the PLIC's hardware enable bit.
Affected products
- Linux Linux Kernel 5.1 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7
Timeline
- 2026-02-12: other: Patch authored
- 2026-03-25: advisory: NVD publication date
- 2026-03-25: patched: Stable kernel updates released
References
- https://git.kernel.org/stable/c/1072020685f4b81f6efad3b412cdae0bd62bb043
- https://git.kernel.org/stable/c/1883332bf21feb8871af09daf604fc4836a76925
- https://git.kernel.org/stable/c/2edbd173309165d103be6c73bd83e459dc45ae7b
- https://git.kernel.org/stable/c/686eb378a4a51aa967e08337dd59daade16aec0f
- https://git.kernel.org/stable/c/8942fb1a5bc2dcbd88f7e656d109d42f778f298f
- https://git.kernel.org/stable/c/f611791a927141d05d7030607dea6372311c1413