CVE-2026-80654

What it actually does

Incorrect NULL check on rx_chan in the remove callback leaves the mailbox rx channel active after device removal, allowing it to receive messages that dereference a freed pointer and trigger use-after-free.

Why it matters to the business

Linux systems using affected Xilinx SoC drivers may experience kernel crashes, memory corruption, or potential privilege escalation, increasing downtime and patching urgency despite currently low observed exploitation.

How an attack unfolds

An attacker with local access triggers device removal (module unload or hot-unplug) while the rx channel is allocated; subsequent messages arriving on the dangling channel pointer cause a use-after-free that can be leveraged for arbitrary kernel code execution.

How to fix it

Apply the upstream fix that replaces the incorrect rx_chan condition check with a proper NULL guard before calling mbox_free_channel and shutdown in the remove callback; rebuild and deploy the patched kernel.

How to confirm the fix worked

Inspect the remove callback for an explicit rx_chan != NULL test before shutdown; perform module load/unload cycles while monitoring dmesg for UAF warnings or mailbox channel leaks.

Typical attack path

1. Load the Xilinx SoC driver to allocate the rx mailbox channel via mbox_request_channel_byname
2. Trigger device removal (rmmod, sysfs unbind, or hardware event) hitting the faulty rx_chan NULL check
3. Send a message to the still-registered mailbox channel after the structure has been freed
4. Exploit the resulting use-after-free for memory corruption or control-flow hijack

How to detect it

Search kernel logs (dmesg, journalctl) for use-after-free warnings or mailbox channel references after driver removal events; correlate with module unload timestamps.

What your security team should do

• Prioritize kernel updates containing the mailbox cleanup correction
• Restrict unprivileged users from loading/unloading the xilinx-soc driver module
• Enable kernel hardening features such as KASAN and hardened usercopy in test environments
• Monitor EPSS and KEV feeds for any future rise in exploit maturity