Xilinx XADC Driver IRQ Handling Race Condition

Executive Summary

This vulnerability in the Linux kernel involves improper cleanup during unbind operations in the Xilinx XADC ADC driver. The issue occurs because the IRQ handler queues work via schedule_delayed_work() but the cleanup order is incorrect. The devm callback should register before devm_request_irq() to ensure the IRQ is freed before the workqueue is cleared, preventing a use-after-free scenario where the handler might re-arm work after the structure is freed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Linux kernel's Xilinx XADC driver and may not have direct network detection methods. Check kernel logs for XADC-related errors or warnings using dmesg | grep xadc or journalctl -k | grep xadc. Ensure the driver is properly unloaded during system operations to detect unbind issues.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could lead to a use-after-free condition, potentially causing system crashes, memory corruption, or privilege escalation if exploited. Systems using the Xilinx XADC driver with alarm IRQs may be affected during driver unbind operations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If using a custom kernel, apply the fix by reordering devm callbacks to register the devm callback before devm_request_irq(). Monitor kernel logs for XADC-related errors after updates.

Useful 0 Not Useful 0