« Volver al listado

CVE-2026-92481

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: mediatek: free EINT resources on unbind

mtk_eint_do_init() creates an IRQ domain, populates it with a mapping for every EINT line and installs a chained handler on the parent interrupt, but none of these are ever released. This was harmless while the drivers were built-in, but now that they can be built as modules and unbound/rmmod'd it leaves behind a dangling IRQ domain, interrupt mappings whose chip data points at freed memory, and a chained handler that keeps firing into that freed data.

The plain allocations in mtk_eint_do_init() already use the device-managed devm_*() helpers, so tear the remaining resources down the same way: register a devm action that detaches the chained handler, waits for any in-flight handler to finish, disposes of the per-line mappings and removes the IRQ domain.

Leer descripción completaMostrar menos

This mirrors the device-managed lifecycle adopted for the GPIO chip and keeps the whole EINT setup self-cleaning on unbind.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-92481",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e46df235b4e605aa4e7609a27c118a1cccd4ff9a",
              "lessThan": "23252bc1cd9a58a039c9b1ae77b22d2b33da48e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e46df235b4e605aa4e7609a27c118a1cccd4ff9a",
              "lessThan": "903a7cdf63a81d3738594c5bd1b5955f58fda427",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e46df235b4e605aa4e7609a27c118a1cccd4ff9a",
              "lessThan": "51552c8c60d3b1fecc062eab2d8cfeaa1cb339dd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e46df235b4e605aa4e7609a27c118a1cccd4ff9a",
              "lessThan": "7f6d898179ca4771ee602bdad4246c3952af83eb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e46df235b4e605aa4e7609a27c118a1cccd4ff9a",
              "lessThan": "e06785cba7f86d72abd531058b1a82d6952a7346",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e46df235b4e605aa4e7609a27c118a1cccd4ff9a",
              "lessThan": "88292b7103d260e3e606eb3bb2794060a5fde48e",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/pinctrl/mediatek/mtk-eint.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/pinctrl/mediatek/mtk-eint.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:50.153",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/23252bc1cd9a58a039c9b1ae77b22d2b33da48e9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/51552c8c60d3b1fecc062eab2d8cfeaa1cb339dd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7f6d898179ca4771ee602bdad4246c3952af83eb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/88292b7103d260e3e606eb3bb2794060a5fde48e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/903a7cdf63a81d3738594c5bd1b5955f58fda427",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e06785cba7f86d72abd531058b1a82d6952a7346",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mediatek: free EINT resources on unbind\n\nmtk_eint_do_init() creates an IRQ domain, populates it with a mapping for\nevery EINT line and installs a chained handler on the parent interrupt,\nbut none of these are ever released. This was harmless while the drivers\nwere built-in, but now that they can be built as modules and\nunbound/rmmod'd it leaves behind a dangling IRQ domain, interrupt mappings\nwhose chip data points at freed memory, and a chained handler that keeps\nfiring into that freed data.\n\nThe plain allocations in mtk_eint_do_init() already use the device-managed\ndevm_*() helpers, so tear the remaining resources down the same way:\nregister a devm action that detaches the chained handler, waits for any\nin-flight handler to finish, disposes of the per-line mappings and removes\nthe IRQ domain. This mirrors the device-managed lifecycle adopted for the\nGPIO chip and keeps the whole EINT setup self-cleaning on unbind."
    }
  ],
  "lastModified": "2026-09-17T17:17:50.153",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}