CVE-2026-23013
EUVD-2026-461625.01.2026, 15:15
In the Linux kernel, the following vulnerability has been resolved: net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to ioq_vector. If request_irq() fails part-way, the rollback loop calls free_irq() with dev_id set to 'oct', which does not match the original dev_id and may leave the irqaction registered. This can keep IRQ handlers alive while ioq_vector is later freed during unwind/teardown, leading to a use-after-free or crash when an interrupt fires. Fix the error path to free IRQs with the same ioq_vector dev_id used during request_irq().Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| linux | linux_kernel | 6.9.1 ≤ 𝑥 < 6.12.67 |
| linux | linux_kernel | 6.13 ≤ 𝑥 < 6.18.7 |
| linux | linux_kernel | 6.9 |
| linux | linux_kernel | 6.19:rc1 |
| linux | linux_kernel | 6.19:rc2 |
| linux | linux_kernel | 6.19:rc3 |
| linux | linux_kernel | 6.19:rc4 |
| linux | linux_kernel | 6.19:rc5 |
| linux | linux_kernel | 6.19:rc6 |
| linux | linux_kernel | 6.19:rc7 |
| linux | linux_kernel | 6.19:rc8 |
𝑥
= Vulnerable software versions
Debian Releases
Common Weakness Enumeration
Vulnerability Media Exposure