Executive brief
The Linux kernel's interrupt controller driver for Renesas RZ/G2L processors contains a race condition that can cause interrupt signals to be lost when multiple interrupts occur simultaneously. This can result in system events (such as GPIO state changes) going unprocessed, potentially causing unresponsive devices or missed critical signals in embedded systems running this kernel.
Technical details
The vulnerability is a race condition in the rzg2l_clear_irq_int() and rzg2l_clear_tint_int() functions within drivers/irqchip/irq-renesas-rzg2l.c. These functions perform a read-modify-write sequence on write-0-to-clear status registers (ISCR/TSCR), which is unsafe when concurrent interrupts arrive. If a new interrupt's status bit is set between the read and write operations, the software-constructed value clears that new bit to zero, inadvertently masking an unprocessed interrupt. The fix modifies the write operation to set only the target bit to zero while leaving all other bits as one, preserving any concurrently-set interrupt status bits. No privileged access or user interaction is required; the race can be triggered by normal hardware interrupt activity.
Affected products
- Linux Linux kernel multiple kernel versions (see kernel.org stable branches)
Timeline
- 2026-09-17: disclosed
- 2026-08-18: patched