Executive brief
The Xilinx audio formatter driver for Linux contains a race condition in the interrupt request registration during device initialization. If a hardware interrupt fires after the IRQ is registered but before driver data is initialized, the interrupt handler receives a null pointer and crashes the kernel. This can cause unexpected system restarts or audio service outages on systems using Xilinx audio hardware.
Technical details
The vulnerability is a null pointer dereference in the ASoC (ALSA System-on-Chip) Xilinx formatter PCM driver. The irq handlers (xlnx_mm2s_irq_handler and xlnx_s2mm_irq_handler) expected to receive driver private data but instead were passed a device pointer, then called dev_get_drvdata() to recover the driver data. However, driver data initialization occurs after devm_request_irq() completes, creating a race window where an interrupt can fire and pass null to readl(), triggering a kernel crash. The fix passes the driver private data structure directly as the devm_request_irq() argument, eliminating the race condition and ensuring handlers always receive valid data.
Affected products
- Linux Linux kernel all versions with ASoC Xilinx formatter PCM driver (introduced by commit 6f6c3c36f091)
Timeline
- 2026-09-03: disclosed: Published on NVD
- 2026-08-06: patched: Patch authored and committed to stable kernel trees
- 2026-08-23: other: Patch integrated into stable releases by Greg Kroah-Hartman