From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793187673; b=mCbL/AAIXUIbaSRldydCIpuIHfrPfrFzb7YcP45vTN/RFSrepYMdkf0STVoQAPB1NF5Q qlTXFJH+n4u9rKs1jHdh/C817jGmPZ3op2y49Urebx92Lm5Q/XDDOhm/nFWhqeeRDydI0 kASogsAWte65RkgsH4kaP2QrC4e9PH2/vV85PPlIVDDukB50hXexHO5auxz3rrMIkQiEI vSL517zHW6Cw6yUFHk9LfH4tXl4xvPKFtznZz/hcKq+bqsRliPe/JZ/JFZELFaMck+U9r XA002v+rtHgviJExrRD3Gx20cwXmTOntT5hR7RMEehLgUoGiK/N8mlw2QgsvB3yUV0w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793187673; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: Reply-To:MIME-Version:Lines:X-Developer-Signature:X-Developer-Key: Content-Transfer-Encoding; bh=70hX818Z4DWkuWfZeOgHArFHABlEmlgxvBWWuQG5tXE=; b=ZJesBr7t3a+7G95dX6Hn97tk34kgfZi4Tp39eK96uFM8FEYFo5HiJ/w+6HPAGI6lhJzd 27egMP+b+C33LGCY5dw5PFOU0IN5LjD2FqyH9piwuDvY+y/8NNC+QXDXDvrRNvfcksYua PlQ/FSZmLVDTeGdJTWlFA/y/SxHmKv9BZGDmwzJVmq8EOMwVqHz1raO4I5YTMwxMlLk2x 4QsVyH3LsOE75pz4AM75Q1Zwb6+ml7D1KUJQirNx2buwGhypYJ5h/5GuNps5P98VBwlrD ibAqr9JUNwhAPqvIwJwiZDaP9n3N4KRxKvGZdn0tPdkjU7eCdAaap34N7bWztCli7PQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=rs5axOln; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 27B40606A31D for ; Wed, 28 Oct 2026 11:41:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=rs5axOln Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E8511F01825; Wed, 28 Oct 2026 11:41:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793187673; bh=70hX818Z4DWkuWfZeOgHArFHABlEmlgxvBWWuQG5tXE=; h=From:To:Cc:Subject:Date:Reply-To; b=rs5axOln4O+fGrOEY7MndUg3PyHyDJjgJ0kp27/yJm9azCMYFuGHDLrQANAzoITA1 7YGkBXbFuHPFUw8gBmM9OO4EZA051xZd9mikfzHqCh0VGPQPlpnmf9q82UX2nyA69r 60pIUc3dGFGa3KZNVaQNTcJFfCj8O9Nc87AZjFG4= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-99189: gpio: mxc: fix race between chained IRQ handler install and probe completion Date: Wed, 28 Oct 2026 11:36:16 +0100 Message-ID: <2026102811-CVE-2026-99189-5582@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2871; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=1VB8mFbU1NAM46R6rY+TjgM7r/vafOLNmuI6ZdtibjE=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkPz99fd72roMyRK+7Ryg1CipLe7/Zdl+pTvhbUVhAdX MXxJmFLRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzkWxvDPEORCwcvt3StrsrS uvz8x7G6Za8ztRgWXDX6kXDvpomOT6TRm0dsdU9LGAyfAgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: gpio: mxc: fix race between chained IRQ handler install and probe completion mxc_update_irq_chained_handler() is called before the IRQ domain, the generic IRQ chip, and the port list entry are set up. If an interrupt arrives in that window: - mx3_gpio_irq_handler() calls generic_handle_domain_irq() with port->domain still NULL. - mx2_gpio_irq_handler() walks mxc_gpio_ports, but the port has not been added to the list yet. Additionally, if any of the subsequent probe steps (gpio_generic_chip_init(), devm_gpiochip_add_data(), irq_domain_create_legacy(), or mxc_gpio_init_gc()) fail, the error paths never unregister the chained handler, leaving a dangling handler that points at freed memory. Move the handler installation after all its dependencies are ready and after list_add_tail(), so the handler is never live while the data structures it touches are incomplete, and is never installed if probe fails. The Linux kernel CVE team has assigned CVE-2026-99189 to this issue. Affected and fixed versions =========================== Issue introduced in 6.6 with commit 5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b and fixed in 6.18.59 with commit 261802c14e1a3281987ea8f106701e5ed9652f68 Issue introduced in 6.6 with commit 5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b and fixed in 7.2.13 with commit 6c1e035d881579a6e4ed1ce5feabb13d23e80a82 Issue introduced in 6.6 with commit 5f6d1998adeb5374ef248b5ba2e2a0c30ab0f60b and fixed in 7.3 with commit 38d44f78f041ffe60c8e2443b99434a199e7541d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-99189 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpio/gpio-mxc.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/261802c14e1a3281987ea8f106701e5ed9652f68 https://git.kernel.org/stable/c/6c1e035d881579a6e4ed1ce5feabb13d23e80a82 https://git.kernel.org/stable/c/38d44f78f041ffe60c8e2443b99434a199e7541d