Executive brief
The Linux kernel's Xilinx power management driver fails to properly clean up a receive mailbox channel when the device is removed, due to an inverted condition check. This allows the mailbox channel to remain active and receive messages even after device removal, leading to use-after-free memory access and potential denial of service or system instability.
Technical details
The vulnerability exists in the Xilinx ZynqMP power management driver (drivers/soc/xilinx/zynqmp_power.c). A receive mailbox channel is allocated during probe but not properly released during device removal due to an incorrect condition check: the code checked `if (!rx_chan)` instead of `if (rx_chan)` before calling `mbox_free_channel()`. This inverted logic prevents the channel from being freed and allows it to receive messages even after device removal, causing use-after-free when the freed driver structures are accessed. The fix corrects the condition to properly free the channel and NULL the pointer. No CVSS score was assigned by NVD.
Affected products
- Linux Linux Kernel multiple versions (fix applied starting 2026-07-24)
Timeline
- 2026-08-28: disclosed: CVE-2026-80654 published
- 2026-07-24: patched: Fix committed to stable kernel branches