CVE-2026-80654 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, particularly those using Xilinx soc drivers, should assess exposure and prioritize verification and remediation efforts. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. System administrators and security teams managing Linux kernel-based systems should also be aware of this vulnerability and take necessary actions.

Why it matters

Defenders should prioritize verifying the Linux kernel version and applying the fix to prevent potential use-after-free errors in the Xilinx soc driver.

• Potential system crashes or unexpected behavior due to use-after-free errors
• Need to verify Linux kernel version and apply fix to prevent vulnerability
• Monitoring system logs for errors related to the Xilinx soc driver

Technical summary

The Linux kernel's Xilinx soc driver has a use-after-free vulnerability. When the device is removed, the rx mailbox channel is not properly shut down, allowing it to receive messages after the device has been removed. This vulnerability exists due to incorrect condition checks in the remove callback. The rx mailbox channel is requested using mbox_request_channel_byname() in probe and not cleaned up properly in remove callback. Defenders should prioritize verifying the Linux kernel version and applying the fix to prevent potential use-after-free errors.

Defensive priority

Defenders should prioritize verifying the Linux kernel version and applying the fix to prevent potential use-after-free errors.

Recommended defensive actions

• Verify Linux kernel version and apply fix
• Monitor system for potential crashes or unexpected behavior
• Review system logs for errors related to the Xilinx soc driver
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and NVD entry provide information about the vulnerability, but do not provide evidence of exploitation or specific affected versions. The Linux kernel's Xilinx soc driver has a use-after-free vulnerability due to improper shutdown of the rx mailbox channel during device removal. Defenders should verify Linux kernel versions and apply fixes to prevent potential use-after-free errors. The vulnerability has been resolved in the Linux kernel.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.