Executive brief
A vulnerability in the Linux kernel's Multi-Function Device (MFD) core could allow a local user to cause a system crash. The issue stems from improper management of internal device lists, which can lead to memory corruption or instability during hardware discovery or removal. This primarily impacts system availability and could lead to a denial-of-service condition.
Technical details
A race condition exists in drivers/mfd/mfd-core.c due to the lack of mutual exclusion when accessing or modifying the 'mfd_of_node_list'. This list tracks Open Firmware (OF) nodes allocated to MFD cells. Without proper locking, concurrent manipulation of this list during device matching (mfd_match_of_node_to_dev) or device removal (mfd_remove_devices_fn) can lead to list corruption and kernel panics. The fix introduces a mutex (mfd_of_node_mutex) to ensure atomic access to the list. An attacker with local access could potentially trigger this condition to cause a denial-of-service.
Affected products
- Linux Linux Kernel 5.9 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2025-12-10: other: Patch authored
- 2026-05-06: advisory: NVD published date
References
- https://git.kernel.org/stable/c/20117c92bcf9c11afd64d7481d8f94fdf410726e
- https://git.kernel.org/stable/c/45341856ecda1d56689451abd5cf1d1aa57dbe47
- https://git.kernel.org/stable/c/9b02e3fec3a7fcb990b4d3bd3b13d7edf123dca6
- https://git.kernel.org/stable/c/db131ef9d8980cf60dcac8cf94c036eccf75e5d0
- https://git.kernel.org/stable/c/dcfa679bba02412f2087be21cf06ae88b1f4e0ef
- https://git.kernel.org/stable/c/e2e7c275f557e2b75e3128f4818063798248774c