CVE-2026-80655 soc: xilinx: Fix race condition in event registration
A race condition in the Xilinx ZynqMP power driver allows a local attacker to trigger a kernel crash via NULL pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80655?
CVE-2026-80655 is a vulnerability in Linux, published on 28 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
soc: xilinx: Fix race condition in event registration
The zynqmp_power driver registers handlers for suspend and subsystem restart events using register_event(). However, the work structures (zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work) used by these handlers were allocated and initialized after the registration call.
This created a race window where, if the firmware triggered an event immediately after registration but before allocation, the callback (suspend_event_callback or subsystem_restart_event_callback) would dereference a NULL pointer in work_pending(), leading to a crash.
Fix this by allocating and initializing the work structures before registering the events.
Which versions are affected by CVE-2026-80655?
How do I fix CVE-2026-80655?
Apply the vendor's patch.
Is CVE-2026-80655 being exploited?
There is no known exploitation of CVE-2026-80655 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-80655, DEBIAN-CVE-2026-80655, GHSA-x28x-mxhh-x47j, UBUNTU-CVE-2026-80655.