Executive brief
The Linux kernel's Aspeed AST2700 interrupt controller driver incorrectly attempted to allocate memory during interrupt setup while holding a spinlock with interrupts disabled. This is a kernel-level coding defect that could cause a system hang or crash during interrupt initialization on affected platforms. The fix replaces the memory-allocating function with a version that reads properties in-place without allocation.
Technical details
The vulnerability is a GFP_KERNEL memory allocation (via fwnode_device_is_compatible() → fwnode_property_match_string()) called from irq_domain_activate() callbacks in aspeed_intc1_irq_domain_activate() and aspeed_intc0_resolve_route(). These callbacks are invoked from __setup_irq() with desc->lock (a raw spinlock) held and interrupts disabled, making blocking allocation impossible. An attacker with local code execution can trigger interrupt setup on affected Aspeed AST2700 systems to cause a system hang or panic. The fix replaces the allocating fwnode_device_is_compatible() with of_device_is_compatible(), which walks device tree properties in place without allocation, requiring no interrupts to be re-enabled.
Affected products
- Linux Linux kernel all versions with ast2700-intc support (introduced in commit 07825e41519a)
Timeline
- 2026-09-17: disclosed
- 2026-08-19: patched: upstream commit b76eee9c2157223aa4aac42ceebb563288e078aa