« Volver al listado

CVE-2026-90124

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

irqchip/renesas-rzg2l: Fix loss of interrupt

rzg2l_clear_irq_int() and rzg2l_clear_tint_int() perform a read-modify-write on the ISCR/TSCR status registers to clear the bit for the interrupt just handled. Since these registers are write-0-to-clear per bit, this is racy:

If another interrupt's status bit gets set between the read and the write, that bit is written back as 0 by the software-constructed value, clearing an interrupt that hasn't been serviced yet and losing it.

This can be reproduced by triggering multiple interrupts at once, e.g.:

Leer descripción completaMostrar menos

Fix this by writing back only the bit being cleared, with all other bits set to 1, instead of read-modify-writing the whole register. Since 1-bits are left unchanged by hardware, concurrently-set status bits for other interrupts are preserved.

Detalles técnicos trazas, registros y código del informe original
  gpioset -c gpiochip0 355=0 353=0 328=0 352=0

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90124",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3fed09559cd8be79568d368ce02bf7f2d56259b6",
              "lessThan": "c043591f03a8111f7d306b8122c444a949486269",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3fed09559cd8be79568d368ce02bf7f2d56259b6",
              "lessThan": "b5ba8b861b5d833394bd23df3f4b59883ef18c88",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3fed09559cd8be79568d368ce02bf7f2d56259b6",
              "lessThan": "3791e242ec2e5a5cd9e010a75ed1125d0e84d394",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3fed09559cd8be79568d368ce02bf7f2d56259b6",
              "lessThan": "38c6831fefde0ff89f8d2dcb924f957a89dec414",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3fed09559cd8be79568d368ce02bf7f2d56259b6",
              "lessThan": "dbecbe23dc606c4af68b4591a41124186f5c1802",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3fed09559cd8be79568d368ce02bf7f2d56259b6",
              "lessThan": "50b10bd0c2d721ad38abd1abe3acdefb6caa0944",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/irqchip/irq-renesas-rzg2l.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/irqchip/irq-renesas-rzg2l.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:04.650",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3791e242ec2e5a5cd9e010a75ed1125d0e84d394",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/38c6831fefde0ff89f8d2dcb924f957a89dec414",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/50b10bd0c2d721ad38abd1abe3acdefb6caa0944",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b5ba8b861b5d833394bd23df3f4b59883ef18c88",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c043591f03a8111f7d306b8122c444a949486269",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dbecbe23dc606c4af68b4591a41124186f5c1802",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip/renesas-rzg2l: Fix loss of interrupt\n\nrzg2l_clear_irq_int() and rzg2l_clear_tint_int() perform a\nread-modify-write on the ISCR/TSCR status registers to clear the bit\nfor the interrupt just handled. Since these registers are\nwrite-0-to-clear per bit, this is racy:\n\nIf another interrupt's status bit gets set between the read and the write,\nthat bit is written back as 0 by the software-constructed value, clearing\nan interrupt that hasn't been serviced yet and losing it.\n\nThis can be reproduced by triggering multiple interrupts at once, e.g.:\n\n  gpioset -c gpiochip0 355=0 353=0 328=0 352=0\n\nFix this by writing back only the bit being cleared, with all other bits\nset to 1, instead of read-modify-writing the whole register.  Since 1-bits\nare left unchanged by hardware, concurrently-set status bits for other\ninterrupts are preserved."
    }
  ],
  "lastModified": "2026-09-17T17:17:04.650",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}