CVE-2026-89455: PCI: plda: Fix use-after-free of event IRQs during teardown

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

PCI: plda: Fix use-after-free of event IRQs during teardown

pldapcieirqdomaindeinit() removes pcie->eventdomain via irqdomainremove(), but the per-event IRQs mapped from that domain are requested with devmrequestirq() in pldainitinterrupts(). The actual freeirq() for a devm-managed IRQ is deferred by devres until after the calling probe()/remove() function returns.

This means irqdomainremove() can free the domain's internal data before the deferred freeirq() for IRQs still mapped into it has run. When devres later processes that deferred cleanup, it can end up dereferencing the already-freed domain.

Free each event IRQ explicitly with devmfreeirq() before removing the domain. This triggers the free immediately and removes the IRQ from the devres tracking list, so devres will not attempt to free it a second time later.

Also dispose of the event, INTx, and MSI IRQ mappings with irqdisposemapping() before their owning domains are removed.

Finally, guard the calls to irqsetchainedhandleranddata() for pcie->irq, pcie->msiirq, and pcie->intxirq so they only run when those fields hold a valid (>0) IRQ number.

This is a pre-existing issue, flagged by automated review during work on an earlier, unrelated patch to this driver.

Build-tested and boot-tested on StarFive VisionFive v1.2A board

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Guard the calls to irq_set_chained_handler_and_data() so they only run when plda_pcie_irq_domain_deinit() removes pcie->event_domain via the domain.

    Linux kernel PCI: plda (IRQ teardown path) guard irq_set_chained_handler_and_data() calls = only run when plda_pcie_irq_domain_deinit() is removing pcie->event_domain via irq_domain_remove()
  2. Configuration

    Guard pcie->irq, pcie->msi_irq, and pcie->intx_irq so that teardown logic only runs when plda_pcie_irq_domain_deinit() removes pcie->event_domain via the domain (only for fields holding valid (>0) IRQ numbers).

    Linux kernel PCI: plda (interrupt teardown fields) IRQ mapping teardown conditions for pcie->irq / pcie->msi_irq / pcie->intx_irq = >0 valid IRQ numbers
  3. Operational

    In plda teardown, dispose of the event, INTx, and MSI IRQ mappings (i.e., ensure irq_domain_remove()/mapping teardown does not leave stale mappings) as part of the teardown sequence.

  4. Operational

    Explicitly free each event IRQ with devm_free_irq() before removing the IRQ domain, so devres deferred cleanup will not later attempt to free an already-freed IRQ/domain mapping.

Event History

Sep 11, 2026
CVE Published
via MITRE·07:43 PM
Data Sourced
via MITRE·07:43 PM
Description

Frequently Asked Questions

1

What systems are exposed to this issue?

Systems using the Linux kernel PLDA PCIe driver are exposed when its teardown path handles event IRQs and removes the associated IRQ domain. The issue concerns driver removal or teardown rather than normal operation described in the available data.

2

What triggers the use-after-free condition?

The condition occurs when irq_domain_remove() frees the event IRQ domain before devres performs its deferred cleanup of IRQs requested with devm_request_irq(). That later cleanup can dereference the domain after it has already been freed.

3

What is the relevant mitigation if an updated kernel is not immediately available?

The provided fix explicitly frees each event IRQ with devm_free_irq() before removing the event domain, then disposes event, INTx, and MSI IRQ mappings before their owning domains are removed. It also guards chained IRQ-handler setup so it runs only for valid IRQ values greater than zero.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203