Executive brief
The Renesas interrupt controller driver in the Linux kernel fails to properly clean up interrupt handling resources when the driver is unloaded, causing memory leaks. More critically, freed resources may still be referenced by system callbacks after removal, leading to system crashes.
Technical details
This is a resource management bug (CWE-401: Missing Release of Memory After Effective Lifetime) in the renesas-irqc interrupt controller driver. During probe, the driver allocates generic interrupt chips but does not set the IRQ_DOMAIN_FLAG_DESTROY_GC flag on the interrupt domain. On driver removal, the generic chips are not automatically freed; they remain on the global list and may be accessed by suspend, resume, or shutdown callbacks after the driver module is unloaded, causing use-after-free and kernel panic. The fix adds one line to set the flag, allowing the interrupt domain core to automatically clean up all resources. No authentication or special privileges required; the vulnerability is triggered on driver removal via module unload or system shutdown.
Affected products
- Linux Linux kernel 2.6.x, 3.x, 4.x, 5.x, 6.x, 7.x (renesas-irqc driver)
Timeline
- 2026-09-17: disclosed: CVE-2026-93072 disclosed
- 2026-07-08: patched: Fix committed upstream (commit 616dd89d81ad9a3cf1cfff4088a4c43e4e00d6ba)
- 2026-09-14: other: Patch backported to stable trees