CVE-2026-89455

Received Received - Intake

Use-After-Free in Linux Kernel PLDA PCIe Driver

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix use-after-free of event IRQs during teardown plda_pcie_irq_domain_deinit() removes pcie->event_domain via irq_domain_remove(), but the per-event IRQs mapped from that domain are requested with devm_request_irq() in plda_init_interrupts(). The actual free_irq() for a devm-managed IRQ is deferred by devres until after the calling probe()/remove() function returns. This means irq_domain_remove() can free the domain's internal data before the deferred free_irq() for IRQs still mapped into it has run. When devres later processes that deferred cleanup, it can end up dereferencing the already-freed domain. Free each event IRQ explicitly with devm_free_irq() before removing the domain. This triggers the free immediately and removes the IRQ from the devres tracking list, so devres will not attempt to free it a second time later. Also dispose of the event, INTx, and MSI IRQ mappings with irq_dispose_mapping() before their owning domains are removed. Finally, guard the calls to irq_set_chained_handler_and_data() for pcie->irq, pcie->msi_irq, and pcie->intx_irq so they only run when those fields hold a valid (>0) IRQ number. This is a pre-existing issue, flagged by automated review during work on an earlier, unrelated patch to this driver. Build-tested and boot-tested on StarFive VisionFive v1.2A board

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89455

EUVD

EUVD-2026-76361

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's PCI driver for PLDA devices. It occurs when the plda_pcie_irq_domain_deinit function removes an IRQ domain while event IRQs mapped to that domain are still pending cleanup. The devm-managed IRQs are freed after the function returns, but the domain's data is already freed, leading to potential dereferencing of freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's PCI subsystem and requires kernel-level inspection. Detection involves checking kernel logs for use-after-free errors related to PCI event IRQs or examining the plda driver's behavior during teardown. Commands like dmesg | grep -i plda or journalctl -k | grep -i plda may reveal issues. Kernel debugging tools like ftrace or KASAN could also help identify memory corruption.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior due to memory corruption. Attackers might exploit it to execute arbitrary code, escalate privileges, or cause denial-of-service conditions on affected systems running vulnerable Linux kernels.

Mitigation Strategies

Apply the latest kernel patches from your distribution to ensure the fix is included. If patches are unavailable, consider disabling the affected plda PCIe driver module or restricting its use. Monitor kernel logs for related errors post-update. Ensure your system runs a kernel version incorporating the fix (post-2026-09-11).

Hi! I’m here to help you understand CVE-2026-89455. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70