CVE-2026-46041

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> greybus: gb-beagleplay: fix sleep in atomic context in hdlc_tx_frames()<br /> <br /> hdlc_append() calls usleep_range() to wait for circular buffer space,<br /> but it is called with tx_producer_lock (a spinlock) held via<br /> hdlc_tx_frames() -&gt; hdlc_append_tx_frame()/hdlc_append_tx_u8()/etc.<br /> Sleeping while holding a spinlock is illegal and can trigger<br /> "BUG: scheduling while atomic".<br /> <br /> Fix this by moving the buffer-space wait out of hdlc_append() and into<br /> hdlc_tx_frames(), before the spinlock is acquired. The new flow:<br /> <br /> 1. Pre-calculate the worst-case encoded frame length.<br /> 2. Wait (with sleep) outside the lock until enough space is available,<br /> kicking the TX consumer work to drain the buffer.<br /> 3. Acquire the spinlock, re-verify space, and write the entire frame<br /> atomically.<br /> <br /> This ensures that sleeping only happens without any lock held, and<br /> that frames are either fully enqueued or not written at all.<br /> <br /> This bug is found by CodeQL static analysis tool (interprocedural<br /> sleep-in-atomic query) and my code review.