PT-2026-128182
CVE-2026-99189
·
Published
2026-10-28
·
Updated
2026-10-28
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
gpio: mxc: fix race between chained IRQ handler install and probe completion
mxc update irq chained handler() is called before the IRQ domain, the
generic IRQ chip, and the port list entry are set up. If an interrupt
arrives in that window:
- mx3 gpio irq handler() calls generic handle domain irq() with port->domain still NULL.
- mx2 gpio irq handler() walks mxc gpio ports, but the port has not been added to the list yet.
Additionally, if any of the subsequent probe steps
(gpio generic chip init(), devm gpiochip add data(),
irq domain create legacy(), or mxc gpio init gc()) fail, the error
paths never unregister the chained handler, leaving a dangling handler
that points at freed memory.
Move the handler installation after all its dependencies are ready and
after list add tail(), so the handler is never live while the data
structures it touches are incomplete, and is never installed if probe
fails.
Found an issue in the description? Have something to add? Feel free to write us 👾