DEBIAN-CVE-2026-99189: Debian/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxcupdateirqchainedhandler() is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that window: - mx3gpioirqhandler() calls generichandledomainirq() with port->domain still NULL. - mx2gpioirqhandler() walks mxcgpioports, but the port has not been added to the list yet. Additionally, if any of the subsequent probe steps (gpiogenericchipinit(), devmgpiochipadddata(), irqdomaincreatelegacy(), or mxcgpioinitgc()) fail, the error paths never unregister the chained handler, leaving a dangling handler that points at freed memory. Move the handler installation after all its dependencies are ready and after listaddtail(), so the handler is never live while the data structures it touches are incomplete, and is never installed if probe fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the mxc GPIO probe path, install the chained IRQ handler only after the IRQ domain, generic IRQ chip, and port list entry have been initialized (after gpio_generic_chip_init(), devm_gpiochip_add_data(), irq_domain_create_legacy(), mxc_gpio_init_gc(), and list_add_tail()); ensure probe failure paths do not leave the handler installed.