CVE-2026-46141: powerpc/xive: fix kmemleak caused by incorrect chip_data lookup
In the Linux kernel, the following vulnerability has been resolved:
powerpc/xive: fix kmemleak caused by incorrect chipdata lookup
The kmemleak reports the following memory leak:
Unreferenced object 0xc0000002a7fbc640 (size 64): comm "kworker/8:1", pid 540, jiffies 4294937872 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 09 04 00 04 00 00 ................ 00 00 a7 81 00 00 0a c0 00 00 08 04 00 04 00 00 ................ backtrace (crc 177d48f6): kmalloccachenoprof+0x520/0x730 xiveirqallocdata.constprop.0+0x40/0xe0 xiveirqdomainalloc+0xd0/0x1b0 irqdomainallocirqsparent+0x44/0x6c pseriesirqdomainalloc+0x1cc/0x354 irqdomainallocirqsparent+0x44/0x6c msidomainalloc+0xb0/0x220 irqdomainallocirqslocked+0x138/0x4d0 irqdomainallocirqs+0x8c/0xfc msidomainallocirqs+0x214/0x4d8 msidomainallocirqsalllocked+0x70/0xf8 pcimsisetupmsiirqs+0x60/0x78 pcienablemsixrange+0x54c/0x98c pciallocirqvectorsaffinity+0x16c/0x1d4 nvmepcienable+0xac/0x9c0 [nvme] nvmeprobe+0x340/0x764 [nvme]
This occurs when allocating MSI-X vectors for an NVMe device. During allocation the XIVE code creates a struct xiveirqdata and stores it in irqdata->chipdata.
When the MSI-X irqdomain is later freed, xiveirqfreedata() is responsible for retrieving this structure and freeing it. However, after commit cc0cc23babc9 ("powerpc/xive: Untangle xive from child interrupt controller drivers"), xiveirqfreedata() retrieves the chipdata using irqgetchipdata(), which looks up the data through the child domain.
This is incorrect because the XIVE-specific irq data is associated with the XIVE (parent) domain. As a result the lookup fails and the allocated struct xiveirqdata is never freed, leading to the kmemleak report shown above.
Fix this by retrieving the irqdata from the correct domain using irqdomaingetirqdata() and then accessing the chipdata via irqdatagetirqchipdata().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Modify xive_irq_free_data() to retrieve the irq_data from the XIVE (parent) domain using irq_domain_get_irq_data() and then free the associated struct xive_irq_data (the xive_irq_alloc_data/xive_irq_alloc_data.constprop.0 allocation). This ensures the struct xive_irq_data is released when the MSI-X irqdomain is freed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46141?
CVE-2026-46141 has a severity rating of 10, indicating critical risk.
How do I fix CVE-2026-46141?
Fixing CVE-2026-46141 involves updating the Linux kernel to a version where this vulnerability has been resolved.
What impact does CVE-2026-46141 have on system performance?
CVE-2026-46141 can result in memory leaks, which may degrade system performance over time.
Which software is affected by CVE-2026-46141?
CVE-2026-46141 affects the Linux kernel with powerpc/xive components.
How can I identify if my system is vulnerable to CVE-2026-46141?
You can identify if your system is vulnerable to CVE-2026-46141 by checking the kernel version and applying security updates.