UBUNTU-CVE-2026-92481: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: free EINT resources on unbind mtkeintdoinit() creates an IRQ domain, populates it with a mapping for every EINT line and installs a chained handler on the parent interrupt, but none of these are ever released. This was harmless while the drivers were built-in, but now that they can be built as modules and unbound/rmmod'd it leaves behind a dangling IRQ domain, interrupt mappings whose chip data points at freed memory, and a chained handler that keeps firing into that freed data. The plain allocations in mtkeintdoinit() already use the device-managed devm() helpers, so tear the remaining resources down the same way: register a devm action that detaches the chained handler, waits for any in-flight handler to finish, disposes of the per-line mappings and removes the IRQ domain. This mirrors the device-managed lifecycle adopted for the GPIO chip and keeps the whole EINT setup self-cleaning on unbind.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
For the MediaTek pinctrl EINT implementation, register a device-managed cleanup action that detaches the chained handler, waits for in-flight handlers to finish, disposes of all per-line IRQ mappings, and removes the IRQ domain during unbind.
Event History
Frequently Asked Questions
Who is most likely to be exposed to this issue?
Systems using the affected Ubuntu kernel packages with MediaTek pinctrl/EINT drivers built as modules are the relevant population. The issue becomes significant when those drivers are unbound or removed, rather than when they remain built into the kernel.
What condition is required to trigger the vulnerable state?
The MediaTek EINT driver must be initialized and later unbound or removed. This can leave an IRQ domain, interrupt mappings, and a parent chained interrupt handler referencing memory that has been freed.
What can be done if an updated kernel cannot be installed immediately?
Avoid unbinding or removing the affected MediaTek pinctrl/EINT driver after it has been initialized. Keeping the driver loaded avoids the described resource teardown path that creates dangling interrupt-related references.
How can an administrator determine whether a system may be affected?
Review whether the running system uses one of the listed Ubuntu kernel package families and whether the MediaTek pinctrl/EINT driver is modular and subject to unbind or rmmod operations. Systems where the driver is built in and never removed are described as having been harmless under this condition.