Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-53332

slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd When the remoteproc starts in parallel with the NGD driver being probed, or the remoteproc is already up when the PDR lookup is being registered, or in the theoretical event that we get an interrupt from the hardware, these callbacks will operate on uninitialized data. This result in issues to boot the affected boards. One such example can be seen in the following fault, where qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work. [ 21.858578] ------------[ cut here ]------------ [ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116 ... [ 21.859251] Call trace: [ 21.859255] __queue_work+0x5e0/0x790 (P) [ 21.859265] queue_work_on+0x6c/0xf0 [ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl] [ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl] [ 21.859318] notifier_call_chain+0xa4/0x230 [ 21.859329] srcu_notifier_call_chain+0x64/0xb8 [ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common] [ 21.859355] rproc_start+0x130/0x230 [ 21.859367] rproc_boot+0x3d4/0x518 ... Move the enablement of interrupts, and the registration of SSR and PDR until after the NGD device has been registered. This could be further refined by moving initialization to the control driver probe and by removing the platform driver model from the picture.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 917809e2280bb83994be8b642373fd941d40c407 to < 946b97d632f0f58a705dafac644c1e9346e01f35affected
  • 917809e2280bb83994be8b642373fd941d40c407 to < 2047eeb38db878a31f58db19d98f8aedf284342eaffected
  • 917809e2280bb83994be8b642373fd941d40c407 to < afc631e246936a40558f494112a4188401382671affected
  • 917809e2280bb83994be8b642373fd941d40c407 to < 290014c7987636e6105bba89fa04cb4d59f775c1affected
  • 917809e2280bb83994be8b642373fd941d40c407 to < fa3790c7ea98328ddc3f7d8bf40247556245a6fcaffected
  • 917809e2280bb83994be8b642373fd941d40c407 to < 24ec89123fc9d0d24ce719dcf7fd6c57e5b0d753affected
  • 917809e2280bb83994be8b642373fd941d40c407 to < 08564e15c47a5fb0af6643a43ee15521d49bcdeaaffected
  • 917809e2280bb83994be8b642373fd941d40c407 to < 2a9d50e9ea406e0c8735938484adc20515ef1b47affected

Linux Linux

Default version status: affected

  • 4.19affected
  • 0 to < 4.19unaffected
  • 5.10.260 to ≤ 5.10.*unaffected
  • 5.15.212 to ≤ 5.15.*unaffected
  • 6.1.178 to ≤ 6.1.*unaffected
  • 6.6.145 to ≤ 6.6.*unaffected
  • 6.12.94 to ≤ 6.12.*unaffected
  • 6.18.36 to ≤ 6.18.*unaffected
  • 7.0.13 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References