Executive brief
A vulnerability was identified in the Linux kernel's Altera PCI controller driver where system resources were not properly cleaned up if the hardware initialization failed. This could lead to a system crash or unstable behavior because the kernel might attempt to use memory that has already been released. This issue primarily affects systems using Altera PCIe hardware components.
Technical details
A resource management flaw exists in drivers/pci/controller/pcie-altera.c. The chained IRQ handler and INTx IRQ domain are initialized during the probe phase but are not torn down if pci_host_probe() fails. Because the host bridge storage is devm-managed, it is released on failure, leaving the IRQ handler with a stale data pointer (use-after-free). Additionally, interrupts are enabled before the probe completes; if it fails, the controller interrupt source remains active. The fix involves reordering the IRQ setup, ensuring interrupts are disabled during teardown, and explicitly calling teardown routines if pci_host_probe() fails.
Affected products
- Linux Linux Kernel 5.9 to 6.10.y
Timeline
- 2026-07-25: disclosed: CVE published and patches available in stable branches.
References
- https://git.kernel.org/stable/c/09c43b7b7d29c6fadb27f32cdf7f3bb6598befa9
- https://git.kernel.org/stable/c/0db9aa9ec51be0a0ffdcdfd9af2b7bf3aeb7911a
- https://git.kernel.org/stable/c/6864c789b570e57f932847fa83f6b56917182d73
- https://git.kernel.org/stable/c/7a94138caeb27f3c49c1dbd93bf422098925bb28
- https://git.kernel.org/stable/c/99fc088d6cc6890ae35fa2f29c50ebe027844c20
- https://git.kernel.org/stable/c/9cf0cc481e1645ec65e61486ae41c486c59781cb
- https://git.kernel.org/stable/c/a25bfa2a6665a1d77324d4a609e7513b87680227