CVE-2026-63798 (GCVE-0-2026-63798)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-08-17 04:51
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove The driver allocates domain generic chips using irq_alloc_domain_generic_chips() during probe and sets up chained handlers using irq_set_chained_handler_and_data(). However, on driver removal, the generic chips are not freed and the chained handlers are not removed. The generic chips remain on the global gc_list and may later be accessed by generic interrupt chip suspend, resume, or shutdown callbacks after the driver has been removed, potentially resulting in a use-after-free and kernel crash. The chained handlers that were installed in probe for peripheral and syswake interrupts are also left dangling, which can lead to spurious interrupts accessing freed memory. Fix these issues by: - Setting IRQ_DOMAIN_FLAG_DESTROY_GC flag in domain->flags, so the core code automatically removes generic chips when irq_domain_remove() is called - Clearing all chained handlers with NULL in pdc_intc_remove()
References
Impacted products
Vendor Product Version
Linux Linux Version: b6ef9161e43ad58c3824bd76dc87716276f0cd70
Version: b6ef9161e43ad58c3824bd76dc87716276f0cd70
Version: b6ef9161e43ad58c3824bd76dc87716276f0cd70
Version: b6ef9161e43ad58c3824bd76dc87716276f0cd70
Version: b6ef9161e43ad58c3824bd76dc87716276f0cd70
Version: b6ef9161e43ad58c3824bd76dc87716276f0cd70
Version: b6ef9161e43ad58c3824bd76dc87716276f0cd70
Version: b6ef9161e43ad58c3824bd76dc87716276f0cd70
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/irqchip/irq-imgpdc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8176773dfceae7978b01c20b233693e072053700",
              "status": "affected",
              "version": "b6ef9161e43ad58c3824bd76dc87716276f0cd70",
              "versionType": "git"
            },
            {
              "lessThan": "c2c7733101bb8c0b29ac9ee41073eaf602821a59",
              "status": "affected",
              "version": "b6ef9161e43ad58c3824bd76dc87716276f0cd70",
              "versionType": "git"
            },
            {
              "lessThan": "83d7ec14b0938ad8cae008058fd6f912f4a9a312",
              "status": "affected",
              "version": "b6ef9161e43ad58c3824bd76dc87716276f0cd70",
              "versionType": "git"
            },
            {
              "lessThan": "44567537a2623dcd2b4018a7f043cf8069579e5d",
              "status": "affected",
              "version": "b6ef9161e43ad58c3824bd76dc87716276f0cd70",
              "versionType": "git"
            },
            {
              "lessThan": "41826e5297e67cd96a0a46fde06a5069a8ce436a",
              "status": "affected",
              "version": "b6ef9161e43ad58c3824bd76dc87716276f0cd70",
              "versionType": "git"
            },
            {
              "lessThan": "b3a3831b2eb884641906fc5e46207b205b6aea13",
              "status": "affected",
              "version": "b6ef9161e43ad58c3824bd76dc87716276f0cd70",
              "versionType": "git"
            },
            {
              "lessThan": "0405a65e4ebd9eac13a765f9f02ac05851ca5421",
              "status": "affected",
              "version": "b6ef9161e43ad58c3824bd76dc87716276f0cd70",
              "versionType": "git"
            },
            {
              "lessThan": "37738fdf2ab1e504d1c63ce5bc0aeb6452d8f057",
              "status": "affected",
              "version": "b6ef9161e43ad58c3824bd76dc87716276f0cd70",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/irqchip/irq-imgpdc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.260",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.177",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.144",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.260",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.211",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.177",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.144",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove\n\nThe driver allocates domain generic chips using\nirq_alloc_domain_generic_chips() during probe and sets up chained\nhandlers using irq_set_chained_handler_and_data(). However, on driver\nremoval, the generic chips are not freed and the chained handlers are\nnot removed.\n\nThe generic chips remain on the global gc_list and may later be accessed by\ngeneric interrupt chip suspend, resume, or shutdown callbacks after the\ndriver has been removed, potentially resulting in a use-after-free and\nkernel crash.\n\nThe chained handlers that were installed in probe for peripheral and\nsyswake interrupts are also left dangling, which can lead to spurious\ninterrupts accessing freed memory.\n\nFix these issues by:\n\n  - Setting IRQ_DOMAIN_FLAG_DESTROY_GC flag in domain-\u003eflags, so the\n    core code automatically removes generic chips when irq_domain_remove()\n    is called\n\n  - Clearing all chained handlers with NULL in pdc_intc_remove()"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:03.369Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8176773dfceae7978b01c20b233693e072053700"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2c7733101bb8c0b29ac9ee41073eaf602821a59"
        },
        {
          "url": "https://git.kernel.org/stable/c/83d7ec14b0938ad8cae008058fd6f912f4a9a312"
        },
        {
          "url": "https://git.kernel.org/stable/c/44567537a2623dcd2b4018a7f043cf8069579e5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/41826e5297e67cd96a0a46fde06a5069a8ce436a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3a3831b2eb884641906fc5e46207b205b6aea13"
        },
        {
          "url": "https://git.kernel.org/stable/c/0405a65e4ebd9eac13a765f9f02ac05851ca5421"
        },
        {
          "url": "https://git.kernel.org/stable/c/37738fdf2ab1e504d1c63ce5bc0aeb6452d8f057"
        }
      ],
      "title": "irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63798",
    "datePublished": "2026-07-19T12:02:05.783Z",
    "dateReserved": "2026-07-19T07:54:57.012Z",
    "dateUpdated": "2026-08-17T04:51:03.369Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.