CVE-2026-90121: irqchip/gic-v5: Clear per-CPU IRS data on teardown
In the Linux kernel, the following vulnerability has been resolved:
irqchip/gic-v5: Clear per-CPU IRS data on teardown
IRS affinity setup publishes an IRS pointer and IAFFID state in the per-CPU data before the remaining IRS initialization can fail. The error path then frees the IRS data without clearing that published state, leaving CPUs associated with freed memory.
On initialization failure and normal IRS teardown, clear the per-CPU IRS association by removing the stale pointer to irsdata. Also invalidate the per-CPU IAFFID state for any CPUs that were tied to the IRS before it was freed.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's irqchip/gic-v5 support and IRS affinity setup are exposed when IRS initialization fails or when an IRS is torn down. The issue concerns per-CPU state associated with IRS data.
What condition triggers the vulnerability?
IRS affinity setup must publish per-CPU IRS pointer and IAFFID state, followed by an initialization failure, or the IRS must later undergo normal teardown. In those cases, the prior behavior could leave CPUs referencing IRS memory after it had been freed.
How can I determine whether a system may already be affected?
Review whether the system has encountered failed IRS initialization or IRS teardown while using irqchip/gic-v5. Affected behavior leaves stale per-CPU irs_data pointers and IAFFID state associated with freed IRS data.
What is the relevant remediation?
Apply the Linux kernel fix that clears the per-CPU IRS association and invalidates IAFFID state for CPUs tied to an IRS before its data is freed. The provided stable references identify fixes for this behavior.