CVE-2026-63798

irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove

MEDIUM
5.5
CVSS Score
Published: July 19, 2026 at 12:02 PM UTC
Updated: August 17, 2026 at 05:17 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.1%

Description

In the Linux kernel, the following vulnerability has been resolved: irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove The driver allocates domain generic chips using irq_alloc_domain_generic_chips() during probe and sets up chained handlers using irq_set_chained_handler_and_data(). However, on driver removal, the generic chips are not freed and the chained handlers are not removed. The generic chips remain on the global gc_list and may later be accessed by generic interrupt chip suspend, resume, or shutdown callbacks after the driver has been removed, potentially resulting in a use-after-free and kernel crash. The chained handlers that were installed in probe for peripheral and syswake interrupts are also left dangling, which can lead to spurious interrupts accessing freed memory. Fix these issues by: - Setting IRQ_DOMAIN_FLAG_DESTROY_GC flag in domain->flags, so the core code automatically removes generic chips when irq_domain_remove() is called - Clearing all chained handlers with NULL in pdc_intc_remove()

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.12 ≤ v < 5.10.2603.12 ≤ v < 5.15.2113.12 ≤ v < 6.1.1773.12 ≤ v < 6.12.953.12 ≤ v < 6.18.383.12 ≤ v < 6.6.1443.12 ≤ v < 7.1.33.12 ≤ v < 7.25.11 ≤ v < 5.15.2115.16 ≤ v < 6.1.1776.13 ≤ v < 6.18.386.19 ≤ v < 7.1.36.2 ≤ v < 6.6.1446.7 ≤ v < 6.12.953.12b6ef9161e43ad58c3824bd76dc87716276f0cd70
Vendor states this is fixed in 0405a65e4ebd9eac13a765f9f02ac05851ca5421 (fixed)
Vendor states this is fixed in 37738fdf2ab1e504d1c63ce5bc0aeb6452d8f057 (fixed)
Vendor states this is fixed in 41826e5297e67cd96a0a46fde06a5069a8ce436a (fixed)
Vendor states this is fixed in 44567537a2623dcd2b4018a7f043cf8069579e5d (fixed)
Vendor states this is fixed in 8176773dfceae7978b01c20b233693e072053700 (fixed)
Vendor states this is fixed in 83d7ec14b0938ad8cae008058fd6f912f4a9a312 (fixed)
Vendor states this is fixed in b3a3831b2eb884641906fc5e46207b205b6aea13 (fixed)
Vendor states this is fixed in c2c7733101bb8c0b29ac9ee41073eaf602821a59 (fixed)
Vendor states this is fixed in 3.12 (unaffected)
Vendor states this is fixed in 5.10.260 (unaffected)
Vendor states this is fixed in 5.15.211 (unaffected)
Vendor states this is fixed in 6.1.177 (unaffected)
Vendor states this is fixed in 6.12.95 (unaffected)
Vendor states this is fixed in 6.18.38 (unaffected)
Vendor states this is fixed in 6.6.144 (unaffected)
Vendor states this is fixed in 7.1.3 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-401

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card