CVE-2026-63862 Overview
CVE-2026-63862 is a resource leak vulnerability in the Linux kernel's MediaTek Gen3 PCI Express (PCIe) controller driver. The flaw resides in the mtk_pcie_setup_irq() function within the pci-mediatek-gen3 driver. The function allocates interrupt request (IRQ) domains before fetching the controller's IRQ. When the IRQ lookup fails, the function returns an error without releasing the previously allocated IRQ domains, causing a memory leak on the error path.
The issue was flagged during upstream review of a patch series adding power control support to the MediaTek Gen3 PCIe driver. The upstream fix reverses the allocation order so IRQ domains are only allocated after the controller's IRQ is successfully retrieved.
Critical Impact
Repeated probe failures on affected MediaTek PCIe hardware can exhaust kernel IRQ domain resources, leading to reduced system stability over time.
Affected Products
- Linux kernel builds including the MediaTek Gen3 PCIe controller driver (pcie-mediatek-gen3)
- Systems using MediaTek SoCs that rely on the Gen3 PCIe host bridge
- Stable kernel branches referenced in the upstream fix commits
Discovery Timeline
- 2026-07-19 - CVE-2026-63862 published to the National Vulnerability Database (NVD)
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-63862
Vulnerability Analysis
The vulnerability is a resource leak in the initialization path of the MediaTek Gen3 PCIe host controller driver. During probe, mtk_pcie_setup_irq() allocates two IRQ domains used for translating MSI and INTx interrupts before it calls the platform helper that retrieves the controller's parent IRQ. If the IRQ retrieval fails, the function returns an error code directly. The previously allocated IRQ domain structures remain registered in kernel data structures, and the memory backing them is never released.
Each failed probe leaks kernel memory and IRQ domain slots. On systems where the PCIe controller probe is retried, repeated failures compound the leak. The upstream fix reorders the initialization sequence, ensuring the controller's IRQ is fetched first and IRQ domains are only created once success is guaranteed.
Root Cause
The root cause is incorrect error-path handling in mtk_pcie_setup_irq(). Resources are allocated before all preconditions are validated. When the subsequent IRQ lookup fails, the cleanup path does not unwind the earlier allocations. This is a classic memory leak pattern in kernel initialization code, closely related to improper release of resources in error paths.
Attack Vector
The vulnerability is triggered by conditions that cause the PCIe controller's IRQ lookup to fail during driver probe. This typically requires local privileges to load or reload the driver, or a device tree configuration that omits or misdescribes the interrupt property. There is no known remote attack vector. The impact is limited to kernel resource exhaustion rather than direct code execution or privilege escalation.
The vulnerability manifests in the initialization sequence of the driver. See the linked kernel commits in the External References section for the exact source-level fix.
Detection Methods for CVE-2026-63862
Indicators of Compromise
- Kernel log entries indicating repeated pcie-mediatek-gen3 probe failures with IRQ acquisition errors
- Growing kernel memory consumption on systems with MediaTek PCIe hardware over long uptimes
- irq_domain entries in /sys/kernel/debug/irq/domains that persist after failed driver loads
Detection Strategies
- Compare running kernel version and patchset against the fixed commits 07a5ecb, 0a2d60e, 215d427, 5573c44, 946b31b, and abd3c19
- Audit device tree source files for correct interrupts properties on MediaTek Gen3 PCIe nodes
- Monitor dmesg output for messages from mtk_pcie_setup_irq reporting IRQ retrieval failures
Monitoring Recommendations
- Track kernel slab allocations related to irq_domain objects using slabtop or eBPF-based tooling
- Alert on repeated driver probe deferrals or failures for pcie-mediatek-gen3 in system logs
- Include kernel version and patch-level inventory as part of routine host telemetry collection
How to Mitigate CVE-2026-63862
Immediate Actions Required
- Identify all Linux hosts running MediaTek SoCs that load the pcie-mediatek-gen3 driver
- Upgrade to a Linux kernel release that includes the referenced upstream fix commits
- For custom kernels, backport the change that moves IRQ domain allocation after IRQ retrieval in mtk_pcie_setup_irq()
Patch Information
The fix is available in multiple stable kernel branches through the following commits: Linux Kernel Commit 07a5ecb, Linux Kernel Commit 0a2d60e, Linux Kernel Commit 215d427, Linux Kernel Commit 5573c44, Linux Kernel Commit 946b31b, and Linux Kernel Commit abd3c19. Apply the vendor kernel update for your distribution once available.
Workarounds
- Ensure device tree bindings correctly declare interrupts for MediaTek Gen3 PCIe nodes to prevent probe-time IRQ lookup failures
- Avoid repeatedly reloading the pcie-mediatek-gen3 module on unpatched systems to limit cumulative leaks
- Reboot systems that have accumulated failed probe attempts to reclaim leaked IRQ domain resources
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
