Executive brief
The pm8001 SCSI driver in the Linux kernel contains a bug in its error handling path when setting up message-signaled interrupts. When interrupt registration fails, the driver attempts to clean up previously registered interrupts but uses incorrect indices, leaving interrupt handlers improperly installed. This can lead to resource leaks and potential system instability or denial of service.
Technical details
The vulnerability is a logic error in the pm8001_request_msix() function where an error-handling rollback loop incorrectly uses the failing iteration index i instead of the loop counter j when calling free_irq(). This passes the wrong IRQ vector number and device ID pair to free_irq(), causing previously registered MSI-X interrupt handlers to remain installed instead of being properly cleaned up. The root cause is in drivers/scsi/pm8001/pm8001_init.c around line 1004-1014. The bug affects any system using the pm8001 SCSI driver when request_irq() fails during MSI-X setup. A fix has been released upstream in commit 3f92a64545165bdbb36dee8fa35626b295463313 and backported to stable kernel trees.
Affected products
- Linux kernel multiple stable versions (2.6.11 through 6.x branches affected; patch available)
Timeline
- 2026-09-16: disclosed: CVE-2026-90007 published
- 2026-09-14: patched: Fix committed upstream and backported to stable trees