CVE-2026-90193

In the Linux kernel, the following vulnerability has been resolved:

mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler

qcom_cpucp_mbox_irq_fn() calls mbox_chan_received_data() while holding

chan->lock. Under PREEMPT_RT, spin_lock_irqsave() is converted to an

rt_spinlock (rtmutex-based), which tracks ownership and can sleep.

The callback chain triggered by mbox_chan_received_data() eventually

reaches mailbox_clear_channel() -> mbox_send_message() -> add_to_rbuf(),

which attempts to re-acquire the same chan->lock. Since rtmutex detects

the re-entrant lock attempt by the same owner, the thread blocks waiting

for a lock it already holds, causing a permanent deadlock.

This deadlock manifests as 'irq/N-apss_cpucp_mbox' stuck in D state

with the following call trace:

rt_spin_lock -> mbox_send_message -> mailbox_clear_channel ->

scmi_rx_callback -> mbox_chan_received_data [<- held chan->lock here]

Fix by saving chan->cl locally and clearing the HW interrupt register

inside the lock, then invoking mbox_chan_received_data() after releasing

the lock. This preserves the mutual exclusion for chan->cl access while

avoiding the lock re-entrancy that causes the PREEMPT_RT deadlock.