UBUNTU-CVE-2026-99189: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxcupdateirqchainedhandler() is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that window: - mx3gpioirqhandler() calls generichandledomainirq() with port->domain still NULL. - mx2gpioirqhandler() walks mxcgpioports, but the port has not been added to the list yet. Additionally, if any of the subsequent probe steps (gpiogenericchipinit(), devmgpiochipadddata(), irqdomaincreatelegacy(), or mxcgpioinitgc()) fail, the error paths never unregister the chained handler, leaving a dangling handler that points at freed memory. Move the handler installation after all its dependencies are ready and after listaddtail(), so the handler is never live while the data structures it touches are incomplete, and is never installed if probe fails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the mxc GPIO probe path, call mxc_update_irq_chained_handler() only after the IRQ domain, generic IRQ chip, port list entry (via list_add_tail()), and other dependencies are initialized, so the handler is not installed if gpio_generic_chip_init(), devm_gpiochip_add_data(), irq_domain_create_legacy(), or mxc_gpio_init_gc() fails.