CVE-2026-23071

Description

A race condition vulnerability was found in the Linux kernel's regmap subsystem when using hardware spinlocks with IRQ save. The shared spinlock_flags member address was passed directly to hwspin_lock_timeout_irqsave(), allowing multiple contexts contending for the lock to overwrite the shared flags variable. This could corrupt the IRQ state for the current lock owner, leading to improper interrupt handling.

Statement

This race condition affects embedded systems using regmap with hardware spinlocks, primarily ARM-based SoCs with shared register access. Exploitation requires concurrent access from multiple contexts and specific timing. The corrupted IRQ state could cause interrupt handling issues, but practical exploitation for code execution is unlikely.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score5.54.7N/A
Attack VectorLocalLocalN/A
Attack ComplexityLowHighN/A
Privileges RequiredLowLowN/A
User InteractionNoneNoneN/A
ScopeUnchangedUnchangedN/A
ConfidentialityNoneNoneN/A
Integrity ImpactNoneNoneN/A
Availability ImpactHighHighN/A

Vector

Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Understanding the Weakness (CWE)

CWE-821

Integrity,Confidentiality,Other

Technical Impact: Modify Application Data; Read Application Data; Alter Execution Logic

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.