CVE-2026-80822

What it actually does

Missing null check after devm_kasprintf() allocation in mchp_ipc_get_cluster_aggr_irq() allows a NULL pointer dereference when the allocation fails, resulting in a kernel crash or memory corruption.

Why it matters to the business

Kernel instability or denial of service on affected Linux systems can interrupt hardware mailbox operations and require system restarts.

How an attack unfolds

An attacker triggers the mchp_ipc_get_cluster_aggr_irq() path under memory pressure so that devm_kasprintf() returns NULL; the subsequent dereference of that pointer without a check leads to a kernel panic or corruption.

How to fix it

Apply the upstream patch that adds the NULL check and returns -ENOMEM on allocation failure; rebuild and deploy the fixed kernel.

How to confirm the fix worked

Inspect the mchp-ipc-sbi driver source for the added NULL check after devm_kasprintf(); verify the kernel version contains the fix or test allocation-failure paths in a lab environment.

Typical attack path

1. Gain local access or execute code that exercises the mailbox IPC path
2. Induce memory exhaustion to force devm_kasprintf() failure
3. Trigger the vulnerable function to dereference the NULL pointer
4. Cause kernel crash or exploit the resulting corruption for further impact

How to detect it

Review kernel logs for oops/panic entries mentioning mchp_ipc_get_cluster_aggr_irq or devm_kasprintf failures; correlate with memory-pressure events.

What your security team should do

• Prioritize kernel updates containing the null-check patch on systems using the mchp-ipc-sbi driver
• Monitor for kernel oops or panic logs referencing mchp_ipc_get_cluster_aggr_irq
• Harden memory allocation paths where feasible and test under low-memory conditions