CVE-2026-63798 Overview
CVE-2026-63798 is a Linux kernel vulnerability in the irqchip/imgpdc driver. The driver fails to release generic interrupt chips and chained handlers when the driver is removed. Allocated resources persist on the global gc_list after removal, creating conditions for a use-after-free when suspend, resume, or shutdown callbacks later access freed memory. Dangling chained handlers for peripheral and syswake interrupts can also trigger spurious interrupts against released memory, potentially leading to a kernel crash.
Critical Impact
Improper cleanup in the imgpdc irqchip driver can result in use-after-free conditions and kernel crashes when generic chip callbacks execute against freed memory after driver removal.
Affected Products
- Linux kernel builds including the irqchip/imgpdc driver prior to the referenced stable commits
- Distributions shipping unpatched stable kernel branches referenced in the fix commits
- Systems using the ImgTec Powerdown Controller (PDC) interrupt controller
Discovery Timeline
- 2026-07-19 - CVE-2026-63798 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-63798
Vulnerability Analysis
The irqchip/imgpdc driver allocates domain generic chips through irq_alloc_domain_generic_chips() during probe and registers chained interrupt handlers with irq_set_chained_handler_and_data(). The driver's removal path does not reverse either of these operations. Generic chips remain linked on the global gc_list and continue to be reachable by the generic interrupt chip infrastructure. When suspend, resume, or shutdown callbacks iterate that list, they can dereference structures whose backing memory has been freed by the driver core [CWE-416].
The chained peripheral and syswake interrupt handlers left installed after removal can also fire and dispatch into freed handler data, producing kernel instability. The EPSS score for CVE-2026-63798 is 0.177% at the 7.486 percentile, reflecting low probability of near-term exploitation, but the kernel stability impact is real for systems that hot-remove the driver.
Root Cause
The driver's pdc_intc_remove() implementation omits cleanup of resources acquired during probe. Without setting IRQ_DOMAIN_FLAG_DESTROY_GC, irq_domain_remove() does not tear down the allocated generic chips. Chained handlers registered on parent interrupts are never cleared, leaving stale function pointers and data references active after the driver module unloads.
Attack Vector
Triggering the flaw requires the driver to be removed while the system continues to exercise the affected interrupt paths. A privileged action such as module unload, followed by a suspend, resume, or shutdown event, drives the generic chip callbacks into freed memory. This is a local, privileged-only condition rather than a network-reachable vulnerability.
Exploitation code is not applicable. The fix commits referenced in the stable tree describe the correct cleanup sequence for driver authors reviewing similar patterns. See Kernel Git Commit 41826e5 for the canonical resolution.
Detection Methods for CVE-2026-63798
Indicators of Compromise
- Kernel oops or panic traces referencing gc_list, irq_gc_suspend, irq_gc_resume, or irq_gc_shutdown after imgpdc driver removal
- Unexpected spurious interrupts logged for peripheral or syswake IRQ lines following an unbind or module unload
- Use-after-free reports from KASAN implicating generic irqchip structures
Detection Strategies
- Audit running kernel versions against the fix commits listed in the kernel stable tree to identify unpatched hosts
- Enable KASAN on test kernels to catch use-after-free access to freed generic chip structures during driver rebind cycles
- Correlate dmesg output for irqchip warnings with driver bind and unbind events in system logs
Monitoring Recommendations
- Collect kernel logs centrally and alert on panic strings involving irq domain or generic chip cleanup paths
- Track module load and unload events for pdc_intc on affected platforms
- Monitor power state transitions on ImgTec PDC-based hardware for correlated kernel warnings
How to Mitigate CVE-2026-63798
Immediate Actions Required
- Upgrade to a Linux kernel release that includes the irqchip/imgpdc cleanup fix from the referenced stable commits
- Avoid unbinding or unloading the pdc_intc driver on production systems until patched kernels are deployed
- Validate vendor kernel builds for embedded ImgTec platforms include the backported fix
Patch Information
The fix sets IRQ_DOMAIN_FLAG_DESTROY_GC in domain->flags so the core code frees generic chips on irq_domain_remove(), and clears chained handlers with NULL in pdc_intc_remove(). Patches are available across multiple stable branches, including commits 0405a65, 37738fd, 41826e5, 4456753, 8176773, 83d7ec1, b3a3831, and c2c7733. Reference the Kernel Git Commit 0405a65 and Kernel Git Commit c2c7733 entries for branch-specific backports.
Workarounds
- Keep the pdc_intc driver statically built and avoid module removal on affected systems
- Restrict privileged access that could trigger driver unbind through sysfs on production hosts
- Defer suspend and shutdown testing on unpatched builds where the driver has been unbound
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
