CVE-2026-63862
Received Received - Intake

PCI: mediatek-gen3 IRQ Domain Leak Fix

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtk_pcie_setup_irq(), the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without cleaning up the allocated domains. Hence, reverse the order so that the IRQ domains are allocated after the controller's IRQ is found. This was flagged by Sashiko during a review of "[PATCH v6 0/7] PCI: mediatek-gen3: add power control support".

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63862
EUVD
EUVD-2026-45546

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where IRQ domains are allocated before checking if the controller's IRQ exists. If the IRQ is not found, the function returns an error without freeing the allocated domains, causing a resource leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's PCI mediatek-gen3 driver and does not have network-based detection methods. Check kernel logs for PCI-related errors or failures during driver initialization using commands like dmesg | grep pcie or journalctl -k | grep mediatek.

Impact Analysis

This vulnerability could lead to system instability or resource exhaustion due to unmanaged IRQ domains. It may cause crashes or degraded performance if the affected PCI device is used.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel PCI driver issue related to IRQ domain management. No evidence suggests it impacts data protection or privacy controls required by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this issue. If updating is not immediately possible, avoid using the mediatek-gen3 PCI driver or disable the affected hardware until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63862. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart