CVE-2026-89964: Linux Kernel EISA DOS Vulnerability

CVE-2026-89964 Overview

CVE-2026-89964 is a denial-of-service vulnerability in the Linux kernel's parisc EISA subsystem. The flaw resides in the eisa_irq_setup() function, which parses the eisa_irq_edge= kernel command line parameter. When the parser encounters an invalid IRQ value (for example, eisa_irq_edge=16,5), it prints an error and continues without advancing the current position. The parser then re-reads the same invalid entry indefinitely, producing an infinite loop during boot. Affected systems fail to complete kernel initialization, rendering the machine unusable until a valid command line is supplied.

Critical Impact
An invalid eisa_irq_edge= parameter triggers an infinite loop during boot on PA-RISC systems, preventing the Linux kernel from completing initialization.

Affected Products

Linux kernel parisc architecture EISA support
Multiple stable kernel branches referenced in upstream fix commits
PA-RISC systems that consume the eisa_irq_edge= boot parameter

Discovery Timeline

2026-09-16 - CVE-2026-89964 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-89964

Vulnerability Analysis

The defect is an infinite loop condition in the eisa_irq_setup() routine used by the parisc architecture. The function parses a comma-separated list supplied through the eisa_irq_edge= kernel command line parameter. Each entry represents an IRQ number the caller wants configured for edge-triggered behavior. When an entry falls outside the valid IRQ range, the function reports the error to the kernel log. It then attempts to continue processing the remaining entries. The bug is that the parser does not move the cursor past the bad entry before continuing. On the next iteration, the parser reads the same invalid token, prints the same error, and repeats indefinitely.

Because this parsing occurs during early kernel initialization, the loop blocks boot completion. Serial consoles fill with repeated error messages, and the system never reaches userspace. This maps to a resource-exhaustion class defect ([CWE-835], loop with unreachable exit condition).

Root Cause

The root cause is missing cursor advancement in the error path of the command line parser. Normal parsing consumes a token and advances past the next comma delimiter. The error-handling branch skips the advancement logic, leaving the parse pointer stationary on the offending characters.

Attack Vector

Exploitation requires the ability to modify kernel boot parameters. This is generally a local, privileged action performed through the bootloader configuration. The bug does not provide remote or unprivileged access. Its practical impact is availability: a misconfigured or maliciously modified boot entry stops a PA-RISC host from booting until the command line is corrected.

// No verified public exploit code is available.
// The fix advances the parser to the next comma-separated entry,
// or terminates parsing when no further entries exist,
// before re-entering the loop after an invalid value.

Detection Methods for CVE-2026-89964

Indicators of Compromise

Repeated eisa_irq_setup() error messages in early boot logs or on the serial console.
PA-RISC systems that stall during kernel initialization without reaching userspace.
Bootloader configuration entries containing an eisa_irq_edge= value with an IRQ outside the supported range.

Detection Strategies

Audit bootloader configurations across PA-RISC fleets for the presence and content of the eisa_irq_edge= parameter.
Correlate boot failures with kernel version and confirm whether the running kernel includes one of the upstream fix commits such as 16a62a3, 21f063e, 3e2691e, 62d88e9, 68659b6, 8640ade, 8b58543, or bb10d54.
Track kernel package versions in configuration management to identify hosts still running vulnerable builds.

Monitoring Recommendations

Forward serial console output and early boot logs to a central log store to catch repeating eisa_irq_setup() errors.
Alert on hosts that fail to reach the expected post-boot state within an expected window.
Include boot-parameter drift detection in configuration compliance checks.

How to Mitigate CVE-2026-89964

Immediate Actions Required

Review any active eisa_irq_edge= values on PA-RISC hosts and remove entries containing IRQ numbers outside the supported range.
Apply the upstream Linux kernel fix from the referenced stable branches to all affected PA-RISC systems.
Validate a bootable rescue path (alternate kernel or recovery entry) before pushing new command lines to production hosts.

Patch Information

The upstream fix modifies eisa_irq_setup() so that the parser advances to the next comma-separated entry, or stops parsing when no further entry exists, before continuing after an invalid value. Fixes are available across multiple stable branches through the following commits: Kernel Contribution 16a62a3, Kernel Contribution 21f063e, Kernel Contribution 3e2691e, Kernel Contribution 62d88e9, Kernel Contribution 68659b6, Kernel Contribution 8640ade, Kernel Contribution 8b58543, and Kernel Contribution bb10d54.

Workarounds

Remove eisa_irq_edge= from the kernel command line if EISA edge-triggered IRQ configuration is not required.
If the parameter is required, validate that every IRQ value falls within the supported range for the platform before deploying the command line.
Restrict bootloader configuration access to trusted administrators so unauthorized users cannot modify kernel command lines.

bash

# Example: inspect the current kernel command line for the vulnerable parameter
cat /proc/cmdline | tr ' ' '\n' | grep '^eisa_irq_edge='

# If present with out-of-range values, edit the bootloader configuration
# (for example /etc/palo.conf or the platform-appropriate loader) and either
# remove the parameter or replace it with validated IRQ values, then reboot.