Bug 2436822 (CVE-2026-23071)

Summary: CVE-2026-23071 kernel: regmap: Fix race condition in hwspinlock irqsave routine
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A race condition vulnerability was found in the Linux kernel's regmap subsystem when using hardware spinlocks with IRQ save. The shared spinlock_flags member address was passed directly to hwspin_lock_timeout_irqsave(), allowing multiple contexts contending for the lock to overwrite the shared flags variable. This could corrupt the IRQ state for the current lock owner, leading to improper interrupt handling.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-02-04 17:05:06 UTC 
In the Linux kernel, the following vulnerability has been resolved:

regmap: Fix race condition in hwspinlock irqsave routine

Previously, the address of the shared member '&map->spinlock_flags' was
passed directly to 'hwspin_lock_timeout_irqsave'. This creates a race
condition where multiple contexts contending for the lock could overwrite
the shared flags variable, potentially corrupting the state for the
current lock owner.

Fix this by using a local stack variable 'flags' to store the IRQ state
temporarily.
Comment 1 Jon Moroney 2026-02-04 19:54:33 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026020418-CVE-2026-23071-675b@gregkh/T