CVE-2024-26788

What it actually does

The qDMA driver initializes interrupt handlers before registers are configured, allowing pending interrupts from a prior kernel to invoke the handler before it is ready, triggering a kernel panic via fsl_qdma_queue_handler.

Why it matters to the business

Systems using Freescale QDMA hardware may experience boot-time crashes and service interruptions, increasing downtime and operational risk especially on servers or embedded devices running affected kernels.

How an attack unfolds

An attacker triggers a reboot or driver reload on a vulnerable system; pending IRQs from the previous state are then delivered to an unprepared handler during probe, causing the kernel to panic before the driver can stabilize.

How to fix it

Update the Linux kernel to include commit 3cc5fb824c2125aa3740d905b3e5b378c8a09478 or later; rebuild and deploy the updated kernel image on all affected systems.

How to confirm the fix worked

Confirm the commit is present in the running kernel source tree; perform a clean boot with the fsl-qdma driver and verify no panic occurs during probe.

Typical attack path

1. Obtain local or physical access to trigger reboot or module reload
2. Ensure pending interrupts exist from prior kernel state
3. Allow fsl_qdma_probe to request IRQs before register setup completes
4. Induce handler execution leading to invalid state and panic

How to detect it

Inspect kernel logs and crash dumps for the exact call trace beginning with fsl_qdma_queue_handler during IRQ setup or device probe.

• fsl_qdma_queue_handler+0xf8/0x3e8
• Call trace showing __handle_irq_event_percpu before fsl_qdma registers ready

What your security team should do

• Prioritize kernel upgrade on all systems using fsl-qdma hardware
• Test updated kernels in staging environments before production rollout
• Monitor boot logs for related panic signatures until patches are applied