CVE-2026-90007: scsi: pm8001: Use rollback index when freeing MSI-X vectors
In the Linux kernel, the following vulnerability has been resolved:
scsi: pm8001: Use rollback index when freeing MSI-X vectors
pm8001requestmsix() unwinds previously registered handlers with freeirq() when requestirq() fails. The rollback loop uses the failing index i for every iteration instead of the already registered vector index j.
That passes the wrong IRQ/devid pair to freeirq() and leaves the earlier handlers installed. Use j for both pciirqvector() and the matching irqvector entry in the rollback loop.
Event History
Frequently Asked Questions
Under what condition is the faulty cleanup path reached?
It is reached when pm8001_request_msix() successfully registers one or more MSI-X interrupt handlers and a later request_irq() call fails.
What is the effect of the failed rollback?
The driver calls free_irq() with the failing vector index rather than each previously registered vector index. As a result, the earlier interrupt handlers can remain installed because the IRQ and dev_id pair does not match the handler being freed.
What does the fix change?
The rollback loop uses the registered-handler index j for both pci_irq_vector() and the corresponding irq_vector entry passed to free_irq(). This frees the handlers that were successfully registered before the request_irq() failure.