What’s Vulnerable › Vulnerabilities

CVE-2026-63862: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-19 · updated 2026-10-26

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtk_pcie_setup_irq(), the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without cleaning up the allocated domains. Hence, reverse the order so that the IRQ domains are allocated after the controller's IRQ is found. This was flagged by Sashiko during a review of "[PATCH v6 0/7] PCI: mediatek-gen3: add power control support".

Affected products

• Linux kernel: from 5.13 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10 — fixed in 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10
• Linux kernel: 5.13 — fixed in 7.1

How to fix

Upgrade to a fixed version: Linux kernel 6.1.175, 6.6.141, 6.12.91, 6.18.33; Linux kernel 7.1. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/07a5ecb94768cbf76fe659e9924000e9ced0c8a6
• https://git.kernel.org/stable/c/0a2d60edc3e57c9512e239ebdfd12204d3368560
• https://git.kernel.org/stable/c/215d4273347b9010a9deae378b0df79c163f707d
• https://git.kernel.org/stable/c/5573c44cb3fd01a9f62d569ae9ac870ef5f0e0ba
• https://git.kernel.org/stable/c/946b31b5a699a2760ee52af0055e5ebf29c5f4cb
• https://git.kernel.org/stable/c/abd3c1927d33766aef39c4640880e3d2637429c2

Get alerted when CVE-2026-63862 or the next vulnerability affects your stack