CVE-2026-89455: PCI: plda: Fix use-after-free of event IRQs during teardown
In the Linux kernel, the following vulnerability has been resolved:
PCI: plda: Fix use-after-free of event IRQs during teardown
pldapcieirqdomaindeinit() removes pcie->eventdomain via irqdomainremove(), but the per-event IRQs mapped from that domain are requested with devmrequestirq() in pldainitinterrupts(). The actual freeirq() for a devm-managed IRQ is deferred by devres until after the calling probe()/remove() function returns.
This means irqdomainremove() can free the domain's internal data before the deferred freeirq() for IRQs still mapped into it has run. When devres later processes that deferred cleanup, it can end up dereferencing the already-freed domain.
Free each event IRQ explicitly with devmfreeirq() before removing the domain. This triggers the free immediately and removes the IRQ from the devres tracking list, so devres will not attempt to free it a second time later.
Also dispose of the event, INTx, and MSI IRQ mappings with irqdisposemapping() before their owning domains are removed.
Finally, guard the calls to irqsetchainedhandleranddata() for pcie->irq, pcie->msiirq, and pcie->intxirq so they only run when those fields hold a valid (>0) IRQ number.
This is a pre-existing issue, flagged by automated review during work on an earlier, unrelated patch to this driver.
Build-tested and boot-tested on StarFive VisionFive v1.2A board
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Call irq_dispose_mapping() for the event, INTx, and MSI IRQ mappings before their owning domains are removed.
Linux kernel PCI PLDA driver IRQ mapping teardown = dispose mappings before removing owning IRQ domains - Configuration
Call devm_free_irq() for each event IRQ before removing the event IRQ domain.
Linux kernel PCI PLDA driver event IRQ teardown = explicitly free before domain removal - Configuration
Guard calls for pcie->irq, pcie->msi_irq, and pcie->intx_irq so they run only when the corresponding field contains a valid (>0) IRQ number.
Linux kernel PCI PLDA driver irq_set_chained_handler_and_data() calls = only execute when the IRQ number is >0
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel PLDA PCIe driver are exposed when its teardown path handles event IRQs and removes the associated IRQ domain. The issue concerns driver removal or teardown rather than normal operation described in the available data.
What triggers the use-after-free condition?
The condition occurs when irq_domain_remove() frees the event IRQ domain before devres performs its deferred cleanup of IRQs requested with devm_request_irq(). That later cleanup can dereference the domain after it has already been freed.
What is the relevant mitigation if an updated kernel is not immediately available?
The provided fix explicitly frees each event IRQ with devm_free_irq() before removing the event domain, then disposes event, INTx, and MSI IRQ mappings before their owning domains are removed. It also guards chained IRQ-handler setup so it runs only for valid IRQ values greater than zero.