CVE-2026-90121 (GCVE-0-2026-90121)
Vulnerability from cvelistv5
Published
2026-09-17 16:06
Modified
2026-10-19 08:58
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Clear per-CPU IRS data on teardown IRS affinity setup publishes an IRS pointer and IAFFID state in the per-CPU data before the remaining IRS initialization can fail. The error path then frees the IRS data without clearing that published state, leaving CPUs associated with freed memory. On initialization failure and normal IRS teardown, clear the per-CPU IRS association by removing the stale pointer to irs_data. Also invalidate the per-CPU IAFFID state for any CPUs that were tied to the IRS before it was freed.
References
Impacted products
Vendor Product Version
Linux Linux Version: 5cb1b6dab2def316671ea2565291a86ad58b884c
Version: 5cb1b6dab2def316671ea2565291a86ad58b884c
Version: 5cb1b6dab2def316671ea2565291a86ad58b884c
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/irqchip/irq-gic-v5-irs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0887d41abf76638942688cb0c0ff8087f52e2b33",
              "status": "affected",
              "version": "5cb1b6dab2def316671ea2565291a86ad58b884c",
              "versionType": "git"
            },
            {
              "lessThan": "54937af6f4a0d44c2852a203d457902f3264c906",
              "status": "affected",
              "version": "5cb1b6dab2def316671ea2565291a86ad58b884c",
              "versionType": "git"
            },
            {
              "lessThan": "3dfc0ab5fefd052c6028c4632b1fad8bdaf7967e",
              "status": "affected",
              "version": "5cb1b6dab2def316671ea2565291a86ad58b884c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/irqchip/irq-gic-v5-irs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/gic-v5: Clear per-CPU IRS data on teardown\n\nIRS affinity setup publishes an IRS pointer and IAFFID state in the\nper-CPU data before the remaining IRS initialization can fail. The\nerror path then frees the IRS data without clearing that published\nstate, leaving CPUs associated with freed memory.\n\nOn initialization failure and normal IRS teardown, clear the per-CPU\nIRS association by removing the stale pointer to irs_data. Also\ninvalidate the per-CPU IAFFID state for any CPUs that were tied to the\nIRS before it was freed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:58:19.637Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0887d41abf76638942688cb0c0ff8087f52e2b33"
        },
        {
          "url": "https://git.kernel.org/stable/c/54937af6f4a0d44c2852a203d457902f3264c906"
        },
        {
          "url": "https://git.kernel.org/stable/c/3dfc0ab5fefd052c6028c4632b1fad8bdaf7967e"
        }
      ],
      "title": "irqchip/gic-v5: Clear per-CPU IRS data on teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90121",
    "datePublished": "2026-09-17T16:06:25.253Z",
    "dateReserved": "2026-09-11T19:38:34.787Z",
    "dateUpdated": "2026-10-19T08:58:19.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.