Executive brief
A vulnerability was identified in the Linux kernel's Xilinx remoteproc driver, which manages communication between the main processor and secondary cores. A missing check when receiving messages could lead to a system crash (NULL pointer dereference). This primarily impacts system stability and availability.
Technical details
A vulnerability in the 'zynqmp_r5_mb_rx_cb' function within 'drivers/remoteproc/xlnx_r5_remoteproc.c' allows for a NULL pointer dereference. The issue occurs because the receive callback does not verify if the 'msg' pointer is NULL before attempting to access its members (specifically 'ipi_msg->len'). An attacker or a malformed Inter-Processor Interrupt (IPI) could trigger this condition, leading to a kernel panic. The fix introduces a check to ensure 'ipi_msg' is valid before proceeding with buffer operations. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux Kernel See references for specific stable branch commits
Timeline
- 2026-03-03: other: Patch authored
- 2026-05-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/06d0bed2552fd0dae27d374d4492a2b672e24eed
- https://git.kernel.org/stable/c/38dd6ccfdfbbe865569a52fe1ba9fa1478f672e6
- https://git.kernel.org/stable/c/5d1451cb2cf6f3d9884d76035a1460aa9bb4b053
- https://git.kernel.org/stable/c/7ddbf21116770b7011f2bb0a6056b7604b24c497
- https://git.kernel.org/stable/c/8242579859a78c801bb626e9aa4823aca93e28e7