HIGH Introduced in 4.11
pm8001 MsixRollback Leak
CVE-2026-90007
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI2.3LOW
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001_request_msix() unwinds previously registered handlers with free_irq() when request_irq() fails. The rollback loop uses the failing index i for every iteration instead of the already registered vector index j. That passes the wrong IRQ/dev_id pair to free_irq() and leaves the earlier handlers installed. Use j for both pci_irq_vector() and the matching irq_vector entry in the rollback loop.
02KernelScan AI Analysis
Risk summary
A bug in the pm8001 SAS/SATA HBA driver's error cleanup path leaks installed interrupt handlers when MSI-X vector registration fails partway through. The rollback loop uses the wrong index, leaving previously registered handlers installed and passing incorrect arguments to the cleanup function. This affects only systems with the specific pm8001 PCIe controller hardware and only manifests under interrupt allocation failure during driver initialization.
Vulnerability analysis
When the pm8001 SAS/SATA HBA driver registers MSI-X interrupt vectors and one registration fails, the error-handling rollback loop should free all previously installed handlers. Instead, it uses the index of the failed vector for every iteration, so it repeatedly attempts to free the never-registered vector while leaving all successfully registered handlers installed and leaked. The fix corrects the loop to use the proper iteration index for both the IRQ number and the handler data, ensuring each registered handler is properly released. This bug is only reachable on systems with the specific pm8001 PCIe SAS controller hardware present, and only triggers when interrupt registration encounters a failure during driver initialization — not through any user-initiated syscall or network input.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 4.11 | 5.10.270 | f39e3ca1f688 |
| 5.15 | 4.11 | 5.15.221 | a980dec7c699 |
| 6.1 | 4.11 | 6.1.188 | 0205db768570 |
| 6.12 | 4.11 | 6.12.110 | fb22a8d2f3ac |
| 6.18 | 4.11 | 6.18.51 | dd817463c9b4 |
| 6.6 | 4.11 | 6.6.157 | 2853ce9c88e0 |
| 7.2 | 4.11 | 7.2.5 | e20b16aa3b49 |
| mainline | 4.11 | 7.3 | 3f92a6454516 |
| cip/5.10 | 4.11 | 5.10.271-cip78 | f39e3ca1f688 |
| cip/6.1 | 4.11 | 6.1.189-cip61 | 0205db768570 |
| cip/6.1-rt | 4.11 | 6.1.189-cip61-rt32 | 0205db768570 |
| cip/6.12 | 4.11 | 6.12.111-cip32 | fb22a8d2f3ac |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |