Executive brief
The Linux kernel's parisc EISA support contains a bug in IRQ configuration parameter parsing that causes the system to hang during boot if an invalid IRQ value is provided. When an administrator specifies an out-of-range IRQ number via the kernel command line, the parser enters an infinite loop instead of skipping to the next parameter, preventing the system from fully booting.
Technical details
The vulnerability is an infinite loop in the eisa_irq_setup() function in drivers/parisc/eisa.c. When an invalid IRQ value (outside the range 0-15) is passed via the "eisa_irq_edge=" kernel command line parameter, the code prints an error message but fails to advance the parser's current position pointer before continuing the parsing loop. This causes the same invalid value to be re-parsed indefinitely. The fix advances to the next comma-separated entry or breaks from the loop when no further entries exist. This is a boot-time denial of service affecting only systems with parisc architecture that receive malformed EISA IRQ configuration parameters.
Affected products
- Linux Linux kernel multiple versions (2.6.11 through 7.2 and later)
Timeline
- 2026-09-16: disclosed
- 2026-08-17: patched: Patch authored by Pei Xiao