CVE-2026-89455 - Vulnerability Details

- PCI: plda: Fix use-after-free of event IRQs during teardown

Description

In the Linux kernel, the following vulnerability has been resolved:

PCI: plda: Fix use-after-free of event IRQs during teardown

plda_pcie_irq_domain_deinit() removes pcie->event_domain via
irq_domain_remove(), but the per-event IRQs mapped from that domain
are requested with devm_request_irq() in plda_init_interrupts(). The
actual free_irq() for a devm-managed IRQ is deferred by devres until
after the calling probe()/remove() function returns.

This means irq_domain_remove() can free the domain's internal data
before the deferred free_irq() for IRQs still mapped into it has run.
When devres later processes that deferred cleanup, it can end up
dereferencing the already-freed domain.

Free each event IRQ explicitly with devm_free_irq() before removing
the domain. This triggers the free immediately and removes the IRQ
from the devres tracking list, so devres will not attempt to free it
a second time later.

Also dispose of the event, INTx, and MSI IRQ mappings with
irq_dispose_mapping() before their owning domains are removed.

Finally, guard the calls to irq_set_chained_handler_and_data() for
pcie->irq, pcie->msi_irq, and pcie->intx_irq so they only run when
those fields hold a valid (>0) IRQ number.

This is a pre-existing issue, flagged by automated review during work
on an earlier, unrelated patch to this driver.

Build-tested and boot-tested on StarFive VisionFive v1.2A board

Published: 2026-09-11

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A use-after-free occurs when the PCI plda driver removes an IRQ domain while IRQs requested with devm_request_irq() are still scheduled for deferred cleanup. When the deferred free_irq() runs, which can cause a kernel crash. This flaw could lead no evidence of remote code execution is indicated.

Affected Systems

The vulnerability exists in the Linux kernel’s plda driver for PCI devices. Any kernel containing the pre‑patch code without the later resolved plda driver is affected. The patch was verified on a StarFive VisionFive v1.2A board.

Risk and Exploitability

The CVSS score of 4.1 indicates a low‑severity flaw primarily affecting availability. The EPSS score is < 1%, indicating a very low exploitation probability, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is local, as the flaw requires the driver to be unloaded or the device to be removed, which an attacker can trigger by manipulating PCI devices or by provoking driver unload/reload events. The exploitability condition is that the device must be removed after driver initialization, a path that typically requires local access or privilege escalation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`76c9113968079140cb2f885631db422170f32105`	affected	< 1d0159e139261996a3ca21798d9114aab2124d3c
`76c9113968079140cb2f885631db422170f32105`	affected	< 01c2f0c66bd1f892db9c6e82976da6b463cc4427
`76c9113968079140cb2f885631db422170f32105`	affected	< e3589ca5f2e6477774753a2202c21509428d4701
`76c9113968079140cb2f885631db422170f32105`	affected	< 26b73bae01d6eb81a4a38f36101812f20b2639de

Linux

affected

Version	Status	Constraints
`6.11`	affected	—
`0`	unaffected	< 6.11
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[76c9113968079140cb2f885631db422170f32105,1d0159e139261996a3ca21798d9114aab2124d3c)`	affected	code_commit	—
`[76c9113968079140cb2f885631db422170f32105,01c2f0c66bd1f892db9c6e82976da6b463cc4427)`	affected	code_commit	—
`[76c9113968079140cb2f885631db422170f32105,e3589ca5f2e6477774753a2202c21509428d4701)`	affected	code_commit	—
`[76c9113968079140cb2f885631db422170f32105,26b73bae01d6eb81a4a38f36101812f20b2639de)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.11,6.11]`	affected	generic	—
`[0,6.11)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a patched Linux kernel that includes the resolved plda driver flaw
Reboot the system after the kernel update to ensure the new driver is in use and check driver health
As an interim measure, avoid hot‑plugging or removal of PCI devices managed by the plda driver until a patch is applied

Generated by OpenCVE AI on September 21, 2026 at 01:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00209.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/01c2f0c66bd1f892db9c6e82976da6b463cc4427
https://git.kernel.org/stable/c/1d0159e139261996a3ca21798d9114aab2124d3c
https://git.kernel.org/stable/c/26b73bae01d6eb81a4a38f36101812f20b2639de
https://git.kernel.org/stable/c/e3589ca5f2e6477774753a2202c21509428d4701
https://nvd.nist.gov/vuln/detail/CVE-2026-89455
https://www.cve.org/CVERecord?id=CVE-2026-89455

History

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89455 https://www.cve.org/CVERecord?id=CVE-2026-89455
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix use-after-free of event IRQs during teardown plda_pcie_irq_domain_deinit() removes pcie->event_domain via irq_domain_remove(), but the per-event IRQs mapped from that domain are requested with devm_request_irq() in plda_init_interrupts(). The actual free_irq() for a devm-managed IRQ is deferred by devres until after the calling probe()/remove() function returns. This means irq_domain_remove() can free the domain's internal data before the deferred free_irq() for IRQs still mapped into it has run. When devres later processes that deferred cleanup, it can end up dereferencing the already-freed domain. Free each event IRQ explicitly with devm_free_irq() before removing the domain. This triggers the free immediately and removes the IRQ from the devres tracking list, so devres will not attempt to free it a second time later. Also dispose of the event, INTx, and MSI IRQ mappings with irq_dispose_mapping() before their owning domains are removed. Finally, guard the calls to irq_set_chained_handler_and_data() for pcie->irq, pcie->msi_irq, and pcie->intx_irq so they only run when those fields hold a valid (>0) IRQ number. This is a pre-existing issue, flagged by automated review during work on an earlier, unrelated patch to this driver. Build-tested and boot-tested on StarFive VisionFive v1.2A board
Title		PCI: plda: Fix use-after-free of event IRQs during teardown
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/01c2f0c66bd1f892db9c6e82976da6b463cc4427 https://git.kernel.org/stable/c/1d0159e139261996a3ca21798d9114aab2124d3c https://git.kernel.org/stable/c/26b73bae01d6eb81a4a38f36101812f20b2639de https://git.kernel.org/stable/c/e3589ca5f2e6477774753a2202c21509428d4701

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:19.370Z

Updated: 2026-09-11T19:43:19.370Z

Reserved: 2026-09-11T19:38:34.707Z

Link: CVE-2026-89455

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:26.220

Modified: 2026-09-11T20:19:26.220

Link: CVE-2026-89455

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:19Z

Links: CVE-2026-89455 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T01:30:08Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object