CVE-2026-89455 Overview
CVE-2026-89455 is a use-after-free vulnerability in the Linux kernel's PLDA PCIe host controller driver. The flaw occurs during device teardown when plda_pcie_irq_domain_deinit() removes the event IRQ domain via irq_domain_remove() while per-event IRQs mapped from that domain remain registered through devm_request_irq(). Because devres defers the actual free_irq() call until after the enclosing probe or remove function returns, the domain's internal data can be released before the deferred cleanup executes. When devres later dereferences the freed domain, memory corruption results. The issue was surfaced by automated review and confirmed on the StarFive VisionFive v1.2A board.
Critical Impact
A use-after-free during PCIe driver teardown can corrupt kernel memory on affected StarFive and other PLDA-based platforms, leading to instability or exploitable conditions.
Affected Products
- Linux kernel PCI PLDA host controller driver (drivers/pci/controller/plda/)
- StarFive JH7100/JH7110 platforms using the PLDA PCIe controller
- Downstream kernels including the PLDA driver prior to the fix commits
Discovery Timeline
- 2026-09-11 - CVE-2026-89455 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-89455
Vulnerability Analysis
The defect is a classic ordering bug between two device-managed cleanup mechanisms in the Linux kernel. The PLDA PCIe driver calls plda_init_interrupts() during probe, which registers per-event IRQ handlers using devm_request_irq(). The device-managed API records the IRQ in the devres list and defers the actual free_irq() invocation until after the probe or remove callback returns.
During teardown, plda_pcie_irq_domain_deinit() invokes irq_domain_remove() directly on pcie->event_domain. This removes the domain immediately, freeing its internal structures. The per-event IRQs still hold mappings into that domain. When devres subsequently walks its cleanup list and calls free_irq(), the IRQ core dereferences fields inside the already-freed domain, producing a use-after-free.
Root Cause
The root cause is a lifetime mismatch between irq_domain_remove() (synchronous) and devm_request_irq() cleanup (deferred by devres). The driver also failed to call irq_dispose_mapping() for event, INTx, and MSI IRQ mappings before their owning domains were destroyed, leaving stale references. Additionally, irq_set_chained_handler_and_data() was called for pcie->irq, pcie->msi_irq, and pcie->intx_irq without validating that the fields held a valid IRQ number greater than zero.
Attack Vector
The flaw is triggered on the teardown path of the PLDA PCIe driver. Local scenarios that unbind, remove, or fail probe of the controller can drive the vulnerable code path. Successful exploitation requires the ability to influence driver lifecycle events, which typically implies local privileged access or a triggerable probe failure. No public exploit is available and the vulnerability is not listed in the CISA KEV catalog.
See the upstream fix commits for the exact code changes: Kernel Git Commit 01c2f0c, Kernel Git Commit 1d0159e, Kernel Git Commit 26b73ba, and Kernel Git Commit e3589ca.
Detection Methods for CVE-2026-89455
Indicators of Compromise
- Kernel oops or panic messages referencing irq_domain, free_irq, or devres_release_all on systems using the PLDA PCIe driver
- KASAN reports flagging use-after-free in irq_domain_remove() or IRQ teardown paths
- Repeated driver unbind or probe-failure events for the PLDA PCIe controller
Detection Strategies
- Enable CONFIG_KASAN and CONFIG_DEBUG_KERNEL on test kernels to catch use-after-free during PLDA driver teardown
- Audit installed kernel versions on StarFive and other PLDA-based platforms against the fix commits listed in the NVD entry
- Monitor dmesg for warnings originating from the plda PCIe driver during hot-unplug or module removal
Monitoring Recommendations
- Collect kernel logs centrally and alert on oops or KASAN signatures from PCIe controller code paths
- Track kernel package versions across the fleet and flag hosts running pre-patch releases of the PLDA driver
- Baseline PCIe driver bind and unbind events to identify anomalous teardown activity on embedded platforms
How to Mitigate CVE-2026-89455
Immediate Actions Required
- Update to a Linux kernel release that includes the PLDA driver fixes referenced by the NVD entry
- Restrict local privileged access to systems that expose the PLDA PCIe controller until patched
- Avoid unbinding or reloading the PLDA PCIe driver in production on unpatched kernels
Patch Information
The fix frees each event IRQ explicitly with devm_free_irq() before removing the domain, which forces the free to occur immediately and removes the entry from devres tracking. The patch also calls irq_dispose_mapping() for event, INTx, and MSI mappings before their owning domains are removed, and guards irq_set_chained_handler_and_data() calls so they run only when the corresponding IRQ number is valid. Apply one of the upstream commits: 01c2f0c66bd1, 1d0159e13926, 26b73bae01d6, or e3589ca5f2e6.
Workarounds
- Keep the PLDA PCIe driver bound for the lifetime of the system to avoid triggering the teardown path
- Disable or remove the PLDA PCIe controller from device tree on platforms where PCIe is not required
- Apply vendor-provided backports for downstream kernels shipped by StarFive or other SoC vendors
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
