CVE-2026-64461: Linux Kernel Privilege Escalation Flaw

CVE-2026-64461 Overview

CVE-2026-64461 is a resource leak vulnerability in the Linux kernel's MediaTek PCI controller driver. When mtk_pcie_enable_port() fails during probe, the driver calls mtk_pcie_port_free() to remove the port from pcie->ports and free the port structure. The interrupt request (IRQ) domains established earlier by mtk_pcie_init_irq_domain() are never released. The issue was surfaced during review of the EcoNet EN7528 System-on-Chip (SoC) support series. The upstream fix refactors teardown logic into a per-port helper and adjusts return semantics so probe and resume paths can be handled distinctly.

Critical Impact

Repeated PCI port enable failures leak IRQ domain resources in kernel memory, degrading system stability on affected MediaTek platforms.

Affected Products

• Linux kernel — MediaTek PCI controller driver (pcie-mediatek)
• Platforms using MediaTek PCIe host bridges, including EcoNet EN7528 SoC
• Stable kernel branches receiving the referenced backport commits

Discovery Timeline

• 2026-07-25 - CVE-2026-64461 published to the National Vulnerability Database (NVD)
• 2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64461

Vulnerability Analysis

The defect resides in the MediaTek PCIe host controller probe path. During initialization, mtk_pcie_init_irq_domain() allocates IRQ domain structures for message signaled interrupts (MSI) and legacy INTx handling. If a subsequent call to mtk_pcie_enable_port() fails for a given port, the driver invokes mtk_pcie_port_free() to unlink and deallocate the port. The IRQ domains that were previously allocated remain referenced but orphaned, producing a persistent memory leak. Each failed probe attempt compounds the leak, which is particularly relevant on platforms that repeatedly cycle PCIe device power or attempt resume operations after transient hardware failures.

Root Cause

The root cause is missing cleanup coverage in the probe error path. mtk_pcie_irq_teardown() operated at the controller level and was not invoked when a single port failed to enable. The upstream patch introduces mtk_pcie_irq_teardown_port(), a per-port helper called from mtk_pcie_setup() when mtk_pcie_enable_port() returns an error. Because IRQ teardown must not run in the NOIRQ resume context, where child devices may hold active MSI mappings and sleeping locks are prohibited, mtk_pcie_enable_port() was changed to return an error code so callers can distinguish the probe and resume paths.

Attack Vector

The attack vector is local and requires the ability to trigger PCIe port enable failures on a vulnerable MediaTek platform. This is not a remotely exploitable code execution flaw. Impact is limited to resource exhaustion and reliability degradation on affected embedded and SoC hardware. No public exploit code, proof-of-concept, or in-the-wild exploitation has been reported. The vulnerability manifests deep within kernel driver initialization; see the referenced upstream commits for the exact code transformations.

// No verified exploitation code available.
// Refer to the upstream Linux kernel commits listed in the References section
// for the authoritative patch diffs and technical detail.

Detection Methods for CVE-2026-64461

Indicators of Compromise

• Kernel log messages from the pcie-mediatek driver reporting mtk_pcie_enable_port failures during probe or resume
• Growing kmalloc allocations attributable to irq_domain_alloc on affected MediaTek boards over time
• Repeated PCIe link training failures preceding gradual memory pressure on embedded devices

Detection Strategies

• Enumerate installed kernel package versions across MediaTek-based fleet assets and compare against fixed stable releases referenced in the upstream commits.
• Parse dmesg and journal logs for mtk_pcie error strings correlated with port enable failure sequences.
• Use kmemleak or similar kernel memory tracking on test systems to confirm IRQ domain leakage during forced probe failure scenarios.

Monitoring Recommendations

• Monitor kernel memory consumption trends on long-running MediaTek SoC devices, alerting on sustained slab growth without workload correlation.
• Track PCIe subsystem error counters and probe retry events through host telemetry pipelines.
• Ingest kernel logs from embedded and networking appliances into a centralized log platform for anomaly review.

How to Mitigate CVE-2026-64461

Immediate Actions Required

• Inventory Linux systems running MediaTek PCIe host controllers, prioritizing EcoNet EN7528 and similar SoC-based platforms.
• Apply vendor-supplied kernel updates that incorporate the upstream fix commits referenced by NVD.
• Validate that resume and suspend cycles complete cleanly after patching, since the fix modifies return-code semantics along that path.

Patch Information

The fix is available in multiple stable Linux kernel branches. Reference commits include Linux Kernel Commit 1fbe897, Linux Kernel Commit 6e6a529, Linux Kernel Commit ce52e49, Linux Kernel Commit df77314, Linux Kernel Commit e23da72, Linux Kernel Commit ec7c05e, Linux Kernel Commit f865a57, and Linux Kernel Commit fe8c701. Apply the version aligned with your maintained stable branch.

Workarounds

• Disable unused PCIe root ports in device tree configuration to prevent failure paths from executing on affected boards.
• Avoid runtime power cycling of PCIe devices on unpatched kernels to limit the number of failed enable attempts.
• Schedule periodic reboots on long-lived embedded devices that cannot be immediately patched to reclaim leaked kernel memory.

# Verify running kernel version and MediaTek PCIe driver presence
uname -r
lsmod | grep -i mediatek
dmesg | grep -Ei 'mtk_pcie|pcie-mediatek'