Executive brief
The Linux kernel's MSC313 real-time clock (RTC) driver contains a race condition during device initialization that can cause the system to crash. When the RTC device is initialized alongside other devices sharing the same interrupt line, a NULL pointer dereference in the interrupt handler can trigger a kernel panic, leading to system unavailability.
Technical details
This is a NULL pointer dereference vulnerability in the rtc-msc313 driver's interrupt handler. The root cause is a race condition between devm_request_irq() and platform_set_drvdata() in the probe function. When IRQF_SHARED is used and another device on the same IRQ line triggers the handler before platform_set_drvdata() completes, dev_get_drvdata() returns NULL. The handler then attempts to dereference the NULL pointer when accessing priv->rtc_base, causing a kernel oops. The fix changes the IRQ cookie from &pdev->dev to priv directly, eliminating the dev_get_drvdata() lookup and removing the probe-order dependency. The vulnerability is local to the kernel and requires device initialization; no remote attack vector exists.
Affected products
- Linux Linux kernel Linux kernel versions with rtc-msc313 driver support (introduced by commit be7d9c9161b9)
Timeline
- 2026-08-15: disclosed: Published in NVD
- 2026-05-11: patched: Fix committed by Stepan Ionichev
- 2026-07-24: other: Patch included in stable kernel releases