CVE-2026-89454 Overview
CVE-2026-89454 is a resource management flaw in the Linux kernel's PCI PLDA host controller driver. The function plda_init_interrupts() initializes interrupt request (IRQ) domains and creates IRQ mappings, but it fails to unwind those allocations when a later initialization step returns an error. When platform_get_irq() or irq_create_mapping() fails, the previously allocated IRQ domains remain registered, and port->intx_irq stays initialized. This leads to leaked kernel resources during error paths in PCI controller probe. The issue was identified through automated review by the sashiko-bot tooling and has been resolved in mainline Linux.
Critical Impact
Failed PCI PLDA controller initialization leaves IRQ domains and mappings dangling in kernel memory, causing resource leaks that can degrade system stability on affected platforms.
Affected Products
- Linux kernel PCI subsystem (PLDA host controller driver)
- Platforms integrating PLDA XpressRICH PCIe controllers
- Stable kernel branches prior to the fix commits referenced in kernel.org
Discovery Timeline
- 2026-09-11 - CVE-2026-89454 published to the National Vulnerability Database (NVD)
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89454
Vulnerability Analysis
The defect resides in the PCI PLDA driver's interrupt setup routine plda_init_interrupts(). This function registers IRQ domains for both INTx and Message Signaled Interrupts (MSI), then calls platform_get_irq() and irq_create_mapping() to bind hardware interrupts to those domains. When any of these later steps fail, the function returns without invoking cleanup helpers.
The consequence is a memory leak in the kernel's IRQ subsystem. Each failed probe attempt leaves orphaned IRQ domain structures and, in the case of a failing irq_create_mapping() call for the MSI IRQ, a live port->intx_irq mapping. Repeated probe failures or module reloads compound the leak.
The fix reroutes error paths to a common label, err_irq_domain_deinit, which invokes plda_pcie_irq_domain_deinit(). The refactored helper now disposes of both the INTx and MSI IRQ mappings before tearing down their domains, eliminating the need for the caller to release port->intx_irq separately.
Root Cause
The root cause is missing cleanup logic in an error-handling path, a classic resource leak pattern in kernel drivers. The original implementation lacked a unified unwind sequence, so partial initialization state was not reversed on failure.
Attack Vector
Exploitation requires local conditions that trigger plda_init_interrupts() failure, such as a misconfigured device tree or hardware fault during PCI probe. The issue is a reliability defect rather than a directly exploitable code execution vector. Attack vector metadata is not published in NVD for this identifier.
See the upstream fix commits for technical details: Kernel Git Commit 01b05ce, Commit 19a30bb, Commit 4b57505, and Commit e54e8d2.
Detection Methods for CVE-2026-89454
Indicators of Compromise
- Repeated PCI PLDA controller probe failures logged in dmesg referencing plda_init_interrupts or platform_get_irq errors.
- Growing IRQ domain counts in /sys/kernel/debug/irq/domains on affected hardware after failed probes.
- Kernel messages indicating irq_create_mapping failures on systems using PLDA XpressRICH PCIe host controllers.
Detection Strategies
- Enumerate loaded kernel versions across Linux fleets and correlate against the fix commits published on kernel.org.
- Monitor kernel logs for PCI subsystem errors that occur during boot or module reload cycles on platforms with PLDA controllers.
- Use vulnerability scanners with current NVD feeds to flag hosts running unpatched kernel builds.
Monitoring Recommendations
- Track kernel memory consumption trends on long-running systems that exercise PCI hotplug or module reload paths.
- Alert on repeated PCI controller initialization failures that could indicate the leak is being triggered.
- Include kernel version telemetry in asset inventories to expedite patch verification.
How to Mitigate CVE-2026-89454
Immediate Actions Required
- Apply the upstream Linux kernel fix commits referenced in the kernel.org stable tree.
- Prioritize patching on embedded and edge devices that use PLDA XpressRICH PCIe host controllers.
- Reboot systems after kernel updates to ensure the patched IRQ handling code is active.
Patch Information
The fix is available in the mainline and stable Linux kernel trees. Refer to the following commits: 01b05ce, 19a30bb, 4b57505, and e54e8d2. Distribution maintainers backport these changes into supported stable branches.
Workarounds
- Disable or unbind the PLDA PCIe host controller driver on systems where the affected hardware is unused.
- Avoid repeated module unload and reload cycles for the PLDA driver until the patched kernel is deployed.
- Ensure device tree configurations are validated to reduce the likelihood of triggering the error path.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
