Executive brief
The TS-4800 interrupt controller driver in the Linux kernel fails to properly clean up interrupt handlers when the driver is unloaded. A dangling handler can be invoked after driver removal when the parent interrupt fires, potentially accessing freed memory and causing a kernel crash or system instability.
Technical details
This is a resource cleanup vulnerability in the ts4800 IRQ controller driver (drivers/irqchip/irq-ts4800.c). During probe, the driver registers a chained interrupt handler via irq_set_chained_handler_and_data() but fails to unregister it in the remove function, leaving a dangling handler reference. Additionally, interrupt mappings created during probe are not disposed, causing resource leaks. The parent interrupt IRQ number is not stored, making cleanup impossible. An attacker with the ability to reload/unload the driver can trigger a use-after-free condition when the parent interrupt fires post-removal. The fix saves the parent_irq value, clears the chained handler with NULL in remove, and properly disposes all IRQ mappings before domain removal.
Affected products
- Linux Linux kernel Various (see stable kernel backports)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched: Fix committed to stable kernel trees