CVE-2026-64462

NameCVE-2026-64462
DescriptionIn the Linux kernel, the following vulnerability has been resolved: PCI: altera: Fix resource leaks on probe failure The chained IRQ handler is set during probe, but is only removed during the driver remove(). If pci_host_probe() fails, the handler and INTx IRQ domain remain set even though the devm-managed host bridge storage containing struct altera_pcie will be released, leaving the handler with a stale data pointer. Interrupts are also enabled before pci_host_probe() is called. If probe fails after that point, the controller interrupt source should be disabled before the chained handler and INTx domain are removed. So set the chained handler only after the INTx domain has been created. Disable controller interrupts during IRQ teardown, and tear the IRQ setup down if pci_host_probe() fails. [mani: commit log]
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6405-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)bullseye5.10.223-1vulnerable
bullseye (security)5.10.259-1vulnerable
bookworm6.1.176-1vulnerable
bookworm (security)6.1.177-1vulnerable
trixie6.12.94-1vulnerable
trixie (security)6.12.100-1fixed
forky7.1.3-1vulnerable
sid7.1.5-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcetrixie6.12.100-1DSA-6405-1
linuxsource(unstable)7.1.4-1

Notes

https://git.kernel.org/linus/7a94138caeb27f3c49c1dbd93bf422098925bb28 (7.2-rc1)

Search for package or bug name: Reporting problems