Linux Kernel MXC GPIO Chained IRQ Race Fix
CVE-2026-99189 Published on October 28, 2026
gpio: mxc: fix race between chained IRQ handler install and probe completion
In the Linux kernel, the following vulnerability has been resolved:
gpio: mxc: fix race between chained IRQ handler install and probe completion
mxc_update_irq_chained_handler() is called before the IRQ domain, the
generic IRQ chip, and the port list entry are set up. If an interrupt
arrives in that window:
- mx3_gpio_irq_handler() calls generic_handle_domain_irq() with
port->domain still NULL.
- mx2_gpio_irq_handler() walks mxc_gpio_ports, but the port has not
been added to the list yet.
Additionally, if any of the subsequent probe steps
(gpio_generic_chip_init(), devm_gpiochip_add_data(),
irq_domain_create_legacy(), or mxc_gpio_init_gc()) fail, the error
paths never unregister the chained handler, leaving a dangling handler
that points at freed memory.
Move the handler installation after all its dependencies are ready and
after list_add_tail(), so the handler is never live while the data
structures it touches are incomplete, and is never installed if probe
fails.
Products Associated with CVE-2026-99189
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b and below 261802c14e1a3281987ea8f106701e5ed9652f68 is affected.
- Version 5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b and below 6c1e035d881579a6e4ed1ce5feabb13d23e80a82 is affected.
- Version 5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b and below 38d44f78f041ffe60c8e2443b99434a199e7541d is affected.
- Version 6.6 is affected.
- Before 6.6 is unaffected.
- Version 6.18.59, <= 6.18.* is unaffected.
- Version 7.2.13, <= 7.2.* is unaffected.
- Version 7.3, <= * is unaffected.