CVE-2026-80654

A flaw was found in the Linux kernel. An incorrect condition check during the cleanup of a mailbox receive channel in the soc: xilinx component allows the channel to remain active and receive messages even after the device has been removed. This oversight leads to a use-after-free vulnerability, where memory is accessed after it has been deallocated. Such a flaw can potentially lead to system instability, denial of service, or privilege escalation.

A flaw of Moderate impact was found in the Linux kernel Xilinx ZynqMP power management driver (drivers/soc/xilinx/zynqmp_power.c). The driver requests a mailbox receive (rx) channel by name during probe, but an incorrect condition check in the remove callback causes the cleanup to run only when the rx channel pointer is NULL, so the channel is not shut down and its resources are not freed when the device is removed. The mailbox channel can continue to receive messages after device removal, resulting in a use-after-free. Exploiting this flaw requires local access to a system using the affected Xilinx ZynqMP hardware and the ability to trigger removal of the device. The most likely consequence is a kernel panic and denial of service; the Red Hat severity of Moderate reflects availability-only impact (CVSS 3.1 base score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). All currently listed Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel components, including kernel-rt and kernel-ivos-qualcomm, have been assessed as not affected because the vulnerable code is not present in the shipped kernel packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.