CVE-2026-89455

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

PCI: plda: Fix use-after-free of event IRQs during teardown

plda_pcie_irq_domain_deinit() removes pcie->event_domain via

irq_domain_remove(), but the per-event IRQs mapped from that domain

are requested with devm_request_irq() in plda_init_interrupts(). The

actual free_irq() for a devm-managed IRQ is deferred by devres until

after the calling probe()/remove() function returns.

This means irq_domain_remove() can free the domain's internal data

before the deferred free_irq() for IRQs still mapped into it has run.

When devres later processes that deferred cleanup, it can end up

dereferencing the already-freed domain.

Free each event IRQ explicitly with devm_free_irq() before removing

the domain. This triggers the free immediately and removes the IRQ

from the devres tracking list, so devres will not attempt to free it

a second time later.

Also dispose of the event, INTx, and MSI IRQ mappings with

irq_dispose_mapping()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References