Cloudanix VulnDB

CVE-2026-80655

None

CVSS

—

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in certain Linux hardware drivers can cause systems to crash when power or restart events happen at exactly the wrong moment.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Race condition in zynqmp_power driver where event handlers for suspend and subsystem restart are registered before their associated work structures are allocated, allowing immediate firmware-triggered events to cause NULL pointer dereference inside work_pending() in the callbacks.

Why it matters to the business

Affected embedded Linux systems on Xilinx ZynqMP platforms may crash during power or restart events, producing unplanned downtime and reduced availability on hardware that relies on this driver.

How an attack unfolds

An attacker or automated process triggers a firmware suspend or restart event in the narrow window after register_event() but before work structure initialization; the callback then dereferences the still-NULL work item, crashing the kernel.

How to fix it

Allocate and initialize zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work before calling register_event(); apply the upstream fix that reorders these operations.

How to confirm the fix worked

Inspect driver source to confirm work structures are allocated prior to event registration; boot on affected hardware and attempt rapid suspend/restart events to verify absence of NULL dereference oops.

Typical attack path

  1. Load vulnerable zynqmp_power driver
  2. Firmware or local trigger fires suspend/restart event before work init
  3. Callback executes work_pending() on uninitialized structure
  4. NULL dereference produces kernel panic

How to detect it

Search kernel logs and crash dumps for oops or panic messages referencing work_pending, suspend_event_callback, or subsystem_restart_event_callback in the zynqmp_power context.

  • work_pending
  • suspend_event_callback
  • subsystem_restart_event_callback
  • zynqmp_pm_init_suspend_work
  • zynqmp_pm_init_restart_work

What your security team should do

  • Apply the kernel patch that moves work allocation before event registration
  • Monitor kernel logs for work_pending NULL dereference crashes on ZynqMP platforms
  • Prioritize updates on production embedded devices that use suspend or subsystem restart

The record

In the Linux kernel, the following vulnerability has been resolved: soc: xilinx: Fix race condition in event registration The zynqmp_power driver registers handlers for suspend and subsystem restart events using register_event(). However, the work structures (zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work) used by these handlers were allocated and initialized after the registration call. This created a race window where, if the firmware triggered an event immediately after registration but before allocation, the callback (suspend_event_callback or subsystem_restart_event_callback) would dereference a NULL pointer in work_pending(), leading to a crash. Fix this by allocating and initializing the work structures before registering the events.

Affected packages

Ecosystem Package Introduced Fixed