UBUNTU-CVE-2026-89455: Use After Free
In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Fix use-after-free of event IRQs during teardown pldapcieirqdomaindeinit() removes pcie->eventdomain via irqdomainremove(), but the per-event IRQs mapped from that domain are requested with devmrequestirq() in pldainitinterrupts(). The actual freeirq() for a devm-managed IRQ is deferred by devres until after the calling probe()/remove() function returns. This means irqdomainremove() can free the domain's internal data before the deferred freeirq() for IRQs still mapped into it has run. When devres later processes that deferred cleanup, it can end up dereferencing the already-freed domain. Free each event IRQ explicitly with devmfreeirq() before removing the domain. This triggers the free immediately and removes the IRQ from the devres tracking list, so devres will not attempt to free it a second time later. Also dispose of the event, INTx, and MSI IRQ mappings with irqdisposemapping() before their owning domains are removed. Finally, guard the calls to irqsetchainedhandleranddata() for pcie->irq, pcie->msiirq, and pcie->intxirq so they only run when those fields hold a valid (>0) IRQ number. This is a pre-existing issue, flagged by automated review during work on an earlier, unrelated patch to this driver. Build-tested and boot-tested on StarFive VisionFive v1.2A board
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Dispose of the event, INTx, and MSI IRQ mappings with irq_dispose_mapping() before the owning IRQ domains are removed.
Linux kernel PCI PLDA driver IRQ-domain teardown = Call irq_dispose_mapping() for event, INTx, and MSI IRQ mappings before removing their owning domains - Configuration
Free each event IRQ explicitly with devm_free_irq() before removing the domain.
Linux kernel PCI PLDA driver Event IRQ teardown = Explicitly free event IRQs before removing the IRQ domain - Configuration
Guard calls to irq_set_chained_handler_and_data() for pcie->irq, pcie->msi_irq, and pcie->intx_irq so they run only when the corresponding field contains a valid (>0) IRQ number.
Linux kernel PCI PLDA driver irq_set_chained_handler_and_data() calls = Only call when the IRQ number is greater than 0