Executive brief
The Qualcomm CPUCP mailbox driver used for inter-processor communication on Qualcomm systems can deadlock under PREEMPT_RT kernel configurations. The issue occurs when interrupt handling logic attempts to acquire a spinlock it already holds, causing the system to hang and become unresponsive.
Technical details
This is a lock re-entrancy bug in the qcom_cpucp_mbox_irq_fn() interrupt handler. The vulnerability occurs specifically under PREEMPT_RT, where standard spinlocks are converted to rt_spinlocks (rtmutex-based), which track lock ownership and detect re-entrant acquisition attempts. The IRQ handler acquires chan->lock and calls mbox_chan_received_data() while holding it. The callback chain triggered by this function eventually reaches mailbox_clear_channel() → mbox_send_message() → add_to_rbuf(), which attempts to re-acquire the same chan->lock. Since rtmutex detects this re-entrant lock attempt by the same thread, it blocks indefinitely waiting for a lock it already owns. The fix involves saving the chan->cl pointer locally and clearing the hardware interrupt register inside the lock, then invoking mbox_chan_received_data() after releasing the lock. This preserves mutual exclusion for critical operations while eliminating the problematic re-entrancy.
Affected products
- Linux Linux kernel multiple versions with qcom-cpucp mailbox driver support
Timeline
- 2026-09-17: disclosed: Published on NVD
- 2026-08-15: patched: Upstream kernel commit 3690aaa6d18f6775c3e7932fb8af8c5bf6a6b69c