Executive brief
A driver for QNAP storage appliances uses a stack buffer to receive serial messages from the device's microcontroller. If a command times out or fails, the buffer pointer remains active, allowing late or unsolicited messages to corrupt the kernel stack. This could lead to kernel crashes, data corruption, or potential code execution on systems running vulnerable QNAP devices.
Technical details
The qnap-mcu driver contains a use-after-free vulnerability involving a stack buffer in qnap_mcu_exec(). The function passes a pointer to its local stack buffer (rx) to the receive path, which runs asynchronously in the serial device receive callback qnap_mcu_receive_buf(). On timeout or write failure, qnap_mcu_exec() returns while reply->data still points to the now-invalid stack frame. Subsequent serial messages write into this deallocated stack memory, corrupting the kernel stack. The root cause is lack of synchronization between the command timeout path and the asynchronous receive handler. The fix moves the buffer from the stack into the persistent driver structure (struct qnap_mcu), eliminating the use-after-free condition.
Affected products
- Linux Linux kernel unknown
Timeline
- 2026-09-11: disclosed: CVE-2026-80975 published
- 2026-09-11: patched: Kernel fix merged