Riskcovery

CVE-2026-23013

net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback

State
Published
Severity
7.0 High
Published
Jan 25, 2026
Updated
Oct 19, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback

octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to ioq_vector. If request_irq() fails part-way, the rollback loop calls free_irq() with dev_id set to 'oct', which does not match the original dev_id and may leave the irqaction registered.

This can keep IRQ handlers alive while ioq_vector is later freed during unwind/teardown, leading to a use-after-free or crash when an interrupt fires.

Fix the error path to free IRQs with the same ioq_vector dev_id used during request_irq().

Scores

CVSSScoreVectorSource
3.17.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 1cd3b407977c3ab1d2ddc26cb7113e7fb1509cd1 to before aa05a8371ae4a452df623f7202c72409d3c50e40Affected
  • 1cd3b407977c3ab1d2ddc26cb7113e7fb1509cd1 to before aa4c066229b05fc3d3c5f42693d25b1828533b6eAffected
  • 1cd3b407977c3ab1d2ddc26cb7113e7fb1509cd1 to before f93fc5d12d69012788f82151bee55fce937e1432Affected
LinuxLinux
  • 6.9Affected
  • before 6.9Not affected
  • 6.12.67 through 6.12.*Not affected
  • 6.18.7 through 6.18.*Not affected
  • 6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.