CVE-2026-46141 Overview
CVE-2026-46141 is a memory leak vulnerability in the Linux kernel's PowerPC XIVE (eXternal Interrupt Virtualization Engine) interrupt controller subsystem. The flaw occurs during MSI-X vector allocation for PCI devices such as NVMe controllers. The xive_irq_free_data() function retrieves chip_data from the child interrupt domain rather than the XIVE parent domain. As a result, the allocated struct xive_irq_data is never freed, producing repeated kmemleak reports on PowerPC systems. The issue was introduced by commit cc0cc23babc9 ("powerpc/xive: Untangle xive from child interrupt controller drivers").
Critical Impact
Kernel memory leaks on PowerPC systems using XIVE interrupt routing can degrade availability over time as MSI-X allocations accumulate unfreed structures.
Affected Products
- Linux kernel on PowerPC (pseries) platforms using the XIVE interrupt controller
- Kernel builds containing commit cc0cc23babc9 ("powerpc/xive: Untangle xive from child interrupt controller drivers")
- Systems allocating MSI-X vectors for PCI devices such as NVMe controllers under XIVE
Discovery Timeline
- 2026-05-28 - CVE-2026-46141 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46141
Vulnerability Analysis
The vulnerability is a kernel memory leak in the powerpc/xive interrupt controller code path. When the kernel allocates MSI-X vectors for a PCI device, xive_irq_alloc_data() allocates a struct xive_irq_data and stores it in irq_data->chip_data on the XIVE parent interrupt domain. The leak manifests during teardown of the MSI-X irqdomain, when xive_irq_free_data() is expected to release this structure.
Kmemleak reports show 64-byte allocations originating from __kmalloc_cache_noprof through xive_irq_alloc_data and xive_irq_domain_alloc, typically triggered by drivers such as nvme invoking pci_alloc_irq_vectors_affinity() during probe.
Root Cause
After commit cc0cc23babc9, xive_irq_free_data() retrieves chip_data using irq_get_chip_data(), which resolves the data through the child interrupt domain. The XIVE-specific data is associated with the parent domain, so the lookup returns the wrong pointer or NULL. The original xive_irq_data allocation is never freed, leaking 64 bytes per affected interrupt. Repeated MSI-X allocation and release cycles compound the leak.
Attack Vector
The condition is triggered by normal kernel operation on PowerPC pseries platforms with XIVE and MSI-X capable devices. It does not require a remote actor. Refer to the upstream commits at kernel.org commit 2546fb8c, kernel.org commit 6771c547, and kernel.org commit e66ed135 for the fix details.
The fix retrieves irq_data from the correct parent domain using irq_domain_get_irq_data() and reads chip_data via irq_data_get_irq_chip_data().
Detection Methods for CVE-2026-46141
Indicators of Compromise
- Kmemleak reports referencing xive_irq_alloc_data.constprop.0 and xive_irq_domain_alloc in the backtrace.
- Repeated 64-byte unreferenced object allocations attributed to __kmalloc_cache_noprof on PowerPC systems.
- Growing slab memory usage on pseries hosts that frequently rebind MSI-X devices such as NVMe controllers.
Detection Strategies
- Enable CONFIG_DEBUG_KMEMLEAK on PowerPC test kernels and scan /sys/kernel/debug/kmemleak for XIVE-related backtraces.
- Compare running kernel commit history against upstream fixes 2546fb8c, 6771c547, and e66ed135 to confirm exposure.
- Track slab allocator metrics over time to identify steady growth tied to MSI-X allocation events.
Monitoring Recommendations
- Monitor /proc/meminfoSlab and SUnreclaim counters on PowerPC hosts running long-lived workloads.
- Alert on repeated kmemleak entries in dmesg containing xive_irq_alloc_data.
- Watch driver bind and unbind cycles for PCI devices using MSI-X on pseries systems.
How to Mitigate CVE-2026-46141
Immediate Actions Required
- Apply the upstream patches referenced in the kernel.org commits to affected stable branches.
- Rebuild and deploy kernels on PowerPC pseries hosts that use the XIVE interrupt controller.
- Inventory PowerPC fleet members running kernels that include commit cc0cc23babc9 without the fix.
Patch Information
The fix is available in the upstream Linux kernel via the commits listed in kernel.org commit 2546fb8c, kernel.org commit 6771c547, and kernel.org commit e66ed135. The patch replaces irq_get_chip_data() with irq_domain_get_irq_data() followed by irq_data_get_irq_chip_data() so that chip_data is resolved on the XIVE parent domain.
Workarounds
- Reboot PowerPC hosts periodically to reclaim leaked slab memory until a patched kernel is deployed.
- Limit dynamic rebinding of MSI-X devices on affected hosts to reduce leak accumulation.
- Track distribution vendor advisories for backported fixes on enterprise kernels such as RHEL and SLES PowerPC builds.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
