CVE-2026-23469

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drm/imagination: Synchronize interrupts before suspending the GPU<br /> <br /> The runtime PM suspend callback doesn&amp;#39;t know whether the IRQ handler is<br /> in progress on a different CPU core and doesn&amp;#39;t wait for it to finish.<br /> <br /> Depending on timing, the IRQ handler could be running while the GPU is<br /> suspended, leading to kernel crashes when trying to access GPU<br /> registers. See example signature below.<br /> <br /> In a power off sequence initiated by the runtime PM suspend callback,<br /> wait for any IRQ handlers in progress on other CPU cores to finish, by<br /> calling synchronize_irq().<br /> <br /> At the same time, remove the runtime PM resume/put calls in the threaded<br /> IRQ handler. On top of not being the right approach to begin with, and<br /> being at the wrong place as they should have wrapped all GPU register<br /> accesses, the driver would hit a deadlock between synchronize_irq()<br /> being called from a runtime PM suspend callback, holding the device<br /> power lock, and the resume callback requiring the same.<br /> <br /> Example crash signature on a TI AM68 SK platform:<br /> <br /> [ 337.241218] SError Interrupt on CPU0, code 0x00000000bf000000 -- SError<br /> [ 337.241239] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT<br /> [ 337.241246] Tainted: [M]=MACHINE_CHECK<br /> [ 337.241249] Hardware name: Texas Instruments AM68 SK (DT)<br /> [ 337.241252] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)<br /> [ 337.241256] pc : pvr_riscv_irq_pending+0xc/0x24<br /> [ 337.241277] lr : pvr_device_irq_thread_handler+0x64/0x310<br /> [ 337.241282] sp : ffff800085b0bd30<br /> [ 337.241284] x29: ffff800085b0bd50 x28: ffff0008070d9eab x27: ffff800083a5ce10<br /> [ 337.241291] x26: ffff000806e48f80 x25: ffff0008070d9eac x24: 0000000000000000<br /> [ 337.241296] x23: ffff0008068e9bf0 x22: ffff0008068e9bd0 x21: ffff800085b0bd30<br /> [ 337.241301] x20: ffff0008070d9e00 x19: ffff0008068e9000 x18: 0000000000000001<br /> [ 337.241305] x17: 637365645f656c70 x16: 0000000000000000 x15: ffff000b7df9ff40<br /> [ 337.241310] x14: 0000a585fe3c0d0e x13: 000000999704f060 x12: 000000000002771a<br /> [ 337.241314] x11: 00000000000000c0 x10: 0000000000000af0 x9 : ffff800085b0bd00<br /> [ 337.241318] x8 : ffff0008071175d0 x7 : 000000000000b955 x6 : 0000000000000003<br /> [ 337.241323] x5 : 0000000000000000 x4 : 0000000000000002 x3 : 0000000000000000<br /> [ 337.241327] x2 : ffff800080e39d20 x1 : ffff800080e3fc48 x0 : 0000000000000000<br /> [ 337.241333] Kernel panic - not syncing: Asynchronous SError Interrupt<br /> [ 337.241337] CPU: 0 UID: 0 PID: 112 Comm: irq/234-gpu Tainted: G M 6.17.7-B2C-00005-g9c7bbe4ea16c #2 PREEMPT<br /> [ 337.241342] Tainted: [M]=MACHINE_CHECK<br /> [ 337.241343] Hardware name: Texas Instruments AM68 SK (DT)<br /> [ 337.241345] Call trace:<br /> [ 337.241348] show_stack+0x18/0x24 (C)<br /> [ 337.241357] dump_stack_lvl+0x60/0x80<br /> [ 337.241364] dump_stack+0x18/0x24<br /> [ 337.241368] vpanic+0x124/0x2ec<br /> [ 337.241373] abort+0x0/0x4<br /> [ 337.241377] add_taint+0x0/0xbc<br /> [ 337.241384] arm64_serror_panic+0x70/0x80<br /> [ 337.241389] do_serror+0x3c/0x74<br /> [ 337.241392] el1h_64_error_handler+0x30/0x48<br /> [ 337.241400] el1h_64_error+0x6c/0x70<br /> [ 337.241404] pvr_riscv_irq_pending+0xc/0x24 (P)<br /> [ 337.241410] irq_thread_fn+0x2c/0xb0<br /> [ 337.241416] irq_thread+0x170/0x334<br /> [ 337.241421] kthread+0x12c/0x210<br /> [ 337.241428] ret_from_fork+0x10/0x20<br /> [ 337.241434] SMP: stopping secondary CPUs<br /> [ 337.241451] Kernel Offset: disabled<br /> [ 337.241453] CPU features: 0x040000,02002800,20002001,0400421b<br /> [ 337.241456] Memory Limit: none<br /> [ 337.457921] ---[ end Kernel panic - not syncing: Asynchronous SError Interrupt ]---