Executive brief
The Linux kernel's remoteproc (remote processor) subsystem had a race condition where driver removal could occur while crash-handling work was scheduled or executing, leading to use-after-free memory errors. This could cause system instability or crashes in systems managing remote processors (common in embedded devices and SoCs with coprocessors). The fix adds synchronization to ensure crash-handler work is properly cancelled before driver removal completes.
Technical details
The vulnerability is a race condition in the remoteproc core between rproc_crash_handler_work() and rproc_del(). When a remoteproc driver was removed, there was no synchronization to prevent crash-handler work from executing after memory was freed, resulting in use-after-free. The fix introduces a "deleting" flag that is checked in atomic-safe contexts (since rproc_report_crash() can be called atomically) to prevent new work scheduling during deletion, combined with cancellation and synchronization of pending work. Additionally, the fix properly handles the pm_stay_awake() balance when work is cancelled. The patch modifies drivers/remoteproc/remoteproc_core.c to add these synchronization checks and a spin lock initialization for crash_handler_lock.
Affected products
- Linux Linux kernel 5.0 and later (prior to patch commit 74ee3b2f5767447c57959994341e5b95f1079977)
Timeline
- 2026-09-17: disclosed: Published to NVD
- 2026-07-23: patched: Fix committed upstream by Bjorn Andersson
- 2026-09-14: other: Fix added to stable kernel tree