slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd (Linux Linux)

CVE-2026-53332
MEDIUM 5.5

At a glance

Source
NVD
EPSS
EPSS 0.13 % · percentile 3 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Modified

Description

In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd-ctrl: Register callbacks after creating the ngd When the remoteproc starts in parallel with the NGD driver being probed, or the remoteproc is already up when the PDR lookup is being registered, or in the theoretical event that we get an interrupt from the hardware, these callbacks will operate on uninitialized data. This result in issues to boot the affected boards. One such example can be seen in the following fault, where qcom_slim_ngd_ssr_pdr_notify() schedules work on the NULL ngd_up_work. [ 21.858578] ------------[ cut here ]------------ [ 21.858745] WARNING: kernel/workqueue.c:2338 at __queue_work+0x5e0/0x790, CPU#2: kworker/2:2/116 ... [ 21.859251] Call trace: [ 21.859255] __queue_work+0x5e0/0x790 (P) [ 21.859265] queue_work_on+0x6c/0xf0 [ 21.859273] qcom_slim_ngd_ssr_pdr_notify+0x110/0x150 [slim_qcom_ngd_ctrl] [ 21.859304] qcom_slim_ngd_ssr_notify+0x24/0x40 [slim_qcom_ngd_ctrl] [ 21.859318] notifier_call_chain+0xa4/0x230 [ 21.859329] srcu_notifier_call_chain+0x64/0xb8 [ 21.859338] ssr_notify_start+0x40/0x78 [qcom_common] [ 21.859355] rproc_start+0x130/0x230 [ 21.859367] rproc_boot+0x3d4/0x518 ... Move the enablement of interrupts, and the registration of SSR and PDR until after the NGD device has been registered. This could be further refined by moving initialization to the control driver probe and by removing the platform driver model from the picture.

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Primary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected 917809e2280bb83994be8b642373fd941d40c407 < 946b97d632f0f58a705dafac644c1e9346e01f35 ; affected 917809e2280bb83994be8b642373fd941d40c407 < 2047eeb38db878a31f58db19d98f8aedf284342e ; affected 917809e2280bb83994be8b642373fd941d40c407 < afc631e246936a40558f494112a4188401382671 ; affected 917809e2280bb83994be8b642373fd941d40c407 < 290014c7987636e6105bba89fa04cb4d59f775c1 ; affected 917809e2280bb83994be8b642373fd941d40c407 < fa3790c7ea98328ddc3f7d8bf40247556245a6fc ; affected 917809e2280bb83994be8b642373fd941d40c407 < 24ec89123fc9d0d24ce719dcf7fd6c57e5b0d753
Linux · Linuxaffected 4.19 ; unaffected 0 < 4.19 ; unaffected 5.10.260 ≤ 5.10.* ; unaffected 5.15.212 ≤ 5.15.* ; unaffected 6.1.178 ≤ 6.1.* ; unaffected 6.6.145 ≤ 6.6.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD