{"id":"CVE-2026-99189","revision":"0919d420a9794a63b8eea68d9d1580f4","records":[{"revision":"0919d420a9794a63b8eea68d9d1580f4","observedAt":"2026-10-28T11:27:43.363+00:00","statement":{"source":"cve-program","id":"CVE-2026-99189","aliases":[],"title":"gpio: mxc: fix race between chained IRQ handler install and probe completion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mxc: fix race between chained IRQ handler install and probe completion\n\nmxc_update_irq_chained_handler() is called before the IRQ domain, the\ngeneric IRQ chip, and the port list entry are set up. If an interrupt\narrives in that window:\n\n - mx3_gpio_irq_handler() calls generic_handle_domain_irq() with\n   port->domain still NULL.\n - mx2_gpio_irq_handler() walks mxc_gpio_ports, but the port has not\n   been added to the list yet.\n\nAdditionally, if any of the subsequent probe steps\n(gpio_generic_chip_init(), devm_gpiochip_add_data(),\nirq_domain_create_legacy(), or mxc_gpio_init_gc()) fail, the error\npaths never unregister the chained handler, leaving a dangling handler\nthat points at freed memory.\n\nMove the handler installation after all its dependencies are ready and\nafter list_add_tail(), so the handler is never live while the data\nstructures it touches are incomplete, and is never installed if probe\nfails.","state":0,"publishedAt":"2026-10-28T10:35:46.366+00:00","modifiedAt":"2026-10-28T10:35:46.366+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpio/gpio-mxc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b\",\n                            \"lessThan\": \"261802c14e1a3281987ea8f106701e5ed9652f68\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b\",\n                            \"lessThan\": \"6c1e035d881579a6e4ed1ce5feabb13d23e80a82\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b\",\n                            \"lessThan\": \"38d44f78f041ffe60c8e2443b99434a199e7541d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/gpio/gpio-mxc.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.6\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.59\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.13\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/261802c14e1a3281987ea8f106701e5ed9652f68","https://git.kernel.org/stable/c/6c1e035d881579a6e4ed1ce5feabb13d23e80a82","https://git.kernel.org/stable/c/38d44f78f041ffe60c8e2443b99434a199e7541d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99189","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99189","identifiers":["CVE-2026-99189"]},"retained":false,"historicalAffected":[]}],"coverage":[]}