CVE-2026-89454

The vulnerability resides in the Linux PCI PLDA driver, where the initialization routine, plda_init_interrupts(), fails to deallocate IRQ domains and mappings when platform_get_irq() or irq_create_mapping() encounters an error. Because the leaked IRQ domains and the kernel can exhaust system resources or become unstable, leading to a resource leak (CWE-772).

All Linux kernel releases that contain the PLDA driver before the patch commit are affected. The vendor is Linux, the product is the Linux kernel; no specific version range is provided, so any kernel that has not applied the patch that removes the IRQ leak is susceptible.

The CVSS score for this issue is 4.4, indicating low severity. The EPSS score is <1%, indicating a very low likelihood of exploitation, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. inferred that exploiting this flaw requires kernel‑privileged code execution, therefore only users with local or privileged access could trigger it. Because the issue is a resource leak rather than an elevation of privilege or remote code execution vector, the exploitation probability is modest, but an attacker could intentionally trigger the leak by repeatedly forcing initialization errors to cause a high‑intensity denial of service. The likely attack vector is inferred to be local, since it depends on the kernel’s handling of PCI device initialization path errors.