Description
In the Linux kernel, the following vulnerability has been resolved:

irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove

The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe and sets up chained
handlers using irq_set_chained_handler_and_data(). However, on driver
removal, the generic chips are not freed and the chained handlers are
not removed.

The generic chips remain on the global gc_list and may later be accessed by
generic interrupt chip suspend, resume, or shutdown callbacks after the
driver has been removed, potentially resulting in a use-after-free and
kernel crash.

The chained handlers that were installed in probe for peripheral and
syswake interrupts are also left dangling, which can lead to spurious
interrupts accessing freed memory.

Fix these issues by:

- Setting IRQ_DOMAIN_FLAG_DESTROY_GC flag in domain->flags, so the
core code automatically removes generic chips when irq_domain_remove()
is called

- Clearing all chained handlers with NULL in pdc_intc_remove()
Published: 2026-07-19
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The irqchip/imgpdc driver in the Linux kernel allocates generic interrupt chips and sets up chained handlers during initialization, but fails to release them upon driver removal. The lingering generic chips remain on a global list and can be accessed by suspend, resume, or shutdown callbacks, creating a use‑after‑free condition that can crash the kernel. Additionally, dangling chained handlers may generate spurious interrupts that reference freed memory, further destabilizing the system. This vulnerability results in loss of availability or a kernel crash and is classified as a resource management flaw (CWE‑772).

Affected Systems

The flaw exists in the Linux operating system kernel. Affected products are all kernel builds that include the irqchip/imgpdc driver; specific version information is not provided in the CVE data, so all deployments that have not applied the recent commit patch remain vulnerable.

Risk and Exploitability

The EPSS score is listed as < 1 %, indicating a very low probability of exploitation in the wild. The vulnerability is not catalogued in the CISA KEV list, suggesting no known exploitation. The likely attack vector is local; an attacker would need privileged access to load or unload the driver or trigger driver removal events to activate the dangling references, which could lead to kernel crashes and availability loss.

Generated by OpenCVE AI on July 30, 2026 at 22:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the system to a kernel version that contains the latest commit (e.g., 2026‑xx‑xx or later) that sets IRQ_DOMAIN_FLAG_DESTROY_GC and clears chained handlers during driver removal.
  • If an upgrade is not immediately possible, backport the patch from the provided kernel commit references to add the missing cleanup code to the driver.
  • Configure system monitoring to alert on kernel Oops or BUG reports that may indicate a use‑after‑free occurring in the irqchip driver.

Generated by OpenCVE AI on July 30, 2026 at 22:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4700-1 linux-6.1 security update
Debian DLA Debian DLA DLA-4717-1 linux security update
History

Tue, 21 Jul 2026 00:15:00 +0000


Sun, 19 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove The driver allocates domain generic chips using irq_alloc_domain_generic_chips() during probe and sets up chained handlers using irq_set_chained_handler_and_data(). However, on driver removal, the generic chips are not freed and the chained handlers are not removed. The generic chips remain on the global gc_list and may later be accessed by generic interrupt chip suspend, resume, or shutdown callbacks after the driver has been removed, potentially resulting in a use-after-free and kernel crash. The chained handlers that were installed in probe for peripheral and syswake interrupts are also left dangling, which can lead to spurious interrupts accessing freed memory. Fix these issues by: - Setting IRQ_DOMAIN_FLAG_DESTROY_GC flag in domain->flags, so the core code automatically removes generic chips when irq_domain_remove() is called - Clearing all chained handlers with NULL in pdc_intc_remove()
Title irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-19T12:02:05.783Z

Reserved: 2026-07-19T07:54:57.012Z

Link: CVE-2026-63798

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity :

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63798 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T22:30:06Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime