CVE-2026-99189: gpio: mxc: fix race between chained IRQ handler install and probe completion

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

gpio: mxc: fix race between chained IRQ handler install and probe completion

mxcupdateirqchainedhandler() is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that window:

- mx3gpioirqhandler() calls generichandledomainirq() with port->domain still NULL. - mx2gpioirqhandler() walks mxcgpioports, but the port has not been added to the list yet.

Additionally, if any of the subsequent probe steps (gpiogenericchipinit(), devmgpiochipadddata(), irqdomaincreatelegacy(), or mxcgpioinitgc()) fail, the error paths never unregister the chained handler, leaving a dangling handler that points at freed memory.

Move the handler installation after all its dependencies are ready and after listaddtail(), so the handler is never live while the data structures it touches are incomplete, and is never installed if probe fails.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 28, 2026

CVE Published

via MITRE·10:35 AM

Data Sourced

via MITRE·10:35 AM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using the Linux kernel mxc GPIO driver are exposed during driver probing if an interrupt can arrive before the driver has finished creating its IRQ domain, generic IRQ chip, and port-list entry. The issue also applies when later probe steps fail after a chained IRQ handler has been installed.

What conditions are needed to trigger the race?

An interrupt must arrive in the short interval after the chained IRQ handler is installed but before its required GPIO and IRQ data structures are ready. On the mx3 handler path, this can invoke domain IRQ handling with a NULL domain; on the mx2 path, the handler can run before the port is present in the global port list.

What is the impact of a probe failure after handler installation?

If GPIO or IRQ initialization fails after the handler is installed, the prior error paths do not unregister that handler. It can remain registered with a pointer to freed memory, creating a dangling handler.

What does the fix change?

The fix delays chained IRQ handler installation until the IRQ dependencies are initialized and the port has been added to the list. This prevents the handler from becoming live during incomplete initialization and avoids installing it when probing fails.

CVE-2026-99189: gpio: mxc: fix race between chained IRQ handler install and probe completion

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What conditions are needed to trigger the race?

What is the impact of a probe failure after handler installation?

What does the fix change?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What conditions are needed to trigger the race?

What is the impact of a probe failure after handler installation?

What does the fix change?