Skip to main content
VulnerabilityPublished Updated

CVE-2026-80654: Linux kernel · soc: xilinx: Shutdown and free rx mailbox channel

Affects Linux kernelSource CVE Database V5

0

Not known to be exploited · fixed in fdee7c66c0d7b6869c36b9f9a915abf29ab5b550 : patch Linux kernel soon.

Data as of 26 Oct 2026, 19:42 UTC

Severity
High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS
0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in fdee7c66c0d7b6869c36b9f9a915abf29ab5b550, b5d2240c2c7bc8370e7ba54a2e1fe3919f55aee5, b0f748c563921a7918c78e6a599cefd54de7d688 +2

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 28 Aug 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

ProductAffectedFixed in
LinuxLinuxAffected
  • ≥ ffdbae28d9d1af70b7d63ffd7827e9795cd8d0df, < fdee7c66c0d7b6869c36b9f9a915abf29ab5b550
Fixed in
  • fdee7c66c0d7b6869c36b9f9a915abf29ab5b550
LinuxLinuxAffected
  • ≥ ffdbae28d9d1af70b7d63ffd7827e9795cd8d0df, < b5d2240c2c7bc8370e7ba54a2e1fe3919f55aee5
Fixed in
  • b5d2240c2c7bc8370e7ba54a2e1fe3919f55aee5
LinuxLinuxAffected
  • ≥ ffdbae28d9d1af70b7d63ffd7827e9795cd8d0df, < b0f748c563921a7918c78e6a599cefd54de7d688
Fixed in
  • b0f748c563921a7918c78e6a599cefd54de7d688
LinuxLinuxAffected
  • ≥ ffdbae28d9d1af70b7d63ffd7827e9795cd8d0df, < a83e77d1e52c01c50096e6e97c57d34e0590d628
Fixed in
  • a83e77d1e52c01c50096e6e97c57d34e0590d628
LinuxLinuxAffected
  • ≥ ffdbae28d9d1af70b7d63ffd7827e9795cd8d0df, < 75ed49f973d790ca3111fcabd516c0b5fd0170b4
Fixed in
  • 75ed49f973d790ca3111fcabd516c0b5fd0170b4
LinuxLinuxAffected
  • =5.6
Fixed in–

AI-suggested

A fix is available in the Linux kernel source code as indicated by the fixed commit versions. Users should update to a kernel version that includes these fixes to remediate the vulnerability.

Description

A use-after-free vulnerability exists in the Linux kernel's Xilinx SoC mailbox driver due to improper cleanup of the receive mailbox channel during device removal. The mailbox channel is not properly shut down and freed, allowing it to receive messages after the device has been removed, which can lead to use-after-free conditions.

References

Community reviews

Loading reviews…