CVE-2026-80975

In the Linux kernel, the following vulnerability has been resolved:

mfd: qnap-mcu: keep the reply buffer alive past a command timeout

qnap mcu exec() publishes an on-stack buffer to the receive path:

unsigned char rx[QNAP MCU RX BUFFER SIZE];
...
reply->data = rx;
reply->length = length;

and qnap mcu receive buf() writes into it from the serdev receive path, which runs out of flush to ldisc() and is not serialized against qnap mcu exec() at all. bus lock cannot cover it, because qnap mcu exec() holds that mutex across wait for completion timeout().

On a timeout qnap mcu exec() returns with reply->data still pointing at its own frame. A reply that arrives late, or an unsolicited message from the MCU, is then written into a stack frame that has been left, corrupting whatever runs next on that stack. The same applies when qnap mcu write() fails, since that path returns without touching the reply state either.

Move the receive buffer into struct qnap mcu. It is 37 bytes and the structure is devm kzalloc()ed, so it lives as long as the driver, and a late write lands in memory that is still valid and is reinitialized by the next command. bus lock keeps commands from sharing it.

This deliberately does not clear reply->data or reply->length on the timeout path. Doing so races with qnap mcu receive buf(), which reads both after its

if (!reply->length)
	return size;

check: clearing reply->data gives a NULL dereference, and clearing reply->length alone removes the reply->received == reply->length exit condition, so the copy loop runs until the uart chunk is consumed and overruns the buffer. Leaving both set keeps the write bounded by reply->length, which qnap mcu exec() has already checked against sizeof(mcu->rx).