CVE-2026-90123: irqchip/ast2700-intc: Avoid allocating in the irq_domain activate() callback
In the Linux kernel, the following vulnerability has been resolved:
irqchip/ast2700-intc: Avoid allocating in the irqdomain activate() callback
The interrupt core calls the irqdomainactivate() callback from setupirq() with desc->lock held and interrupts disabled. Both aspeedintc1irqdomainactivate() and aspeedintc0resolveroute() test a compatible string with fwnodedeviceiscompatible().
fwnodedeviceiscompatible() invokes fwnodepropertymatchstring(), which allocates with GFPKERNEL. That's obviously not possible with interrupts disabled and a raw spinlock held.
Both call sites are only ever handed OF nodes, so use ofdeviceiscompatible() instead: it walks the property in place and does not allocate.
Event History
Frequently Asked Questions
Is this limited to device tree-backed interrupt-controller nodes?
Yes. Both affected call sites are only handed OF nodes, so the non-allocating OF-specific compatibility check can be used safely.
When can the unsafe allocation occur?
It can occur while an IRQ is being set up, when the interrupt core invokes the irq-domain activation callback with the descriptor lock held and interrupts disabled. The affected paths are aspeed_intc1_irq_domain_activate() and aspeed_intc0_resolve_route().