CVE-2026-90007 Overview
CVE-2026-90007 affects the Linux kernel pm8001 SCSI driver. The pm8001_request_msix() function contains a flawed rollback loop when handling request_irq() failures. The cleanup path calls free_irq() using the failing loop index i instead of the already-registered vector index j. This passes an incorrect IRQ and dev_id pair to free_irq(), leaving earlier interrupt handlers installed and corrupting kernel driver state on PMC-Sierra SAS/SATA host bus adapters.
Critical Impact
A local user with driver-loading capability can trigger memory corruption, kernel state inconsistency, and potential privilege escalation through the mishandled MSI-X vector cleanup path.
Affected Products
- Linux kernel with the pm8001 SCSI driver enabled
- Systems using PMC-Sierra PM8001 SAS/SATA host bus adapters
- Distributions shipping kernels prior to the fixes referenced in the upstream stable commits
Discovery Timeline
- 2026-09-16 - CVE-2026-90007 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90007
Vulnerability Analysis
The defect resides in the interrupt registration path of the pm8001 SCSI driver. When the driver initializes multiple MSI-X vectors, it iterates through each vector calling request_irq(). If any call fails partway through the loop, the driver must roll back previously registered handlers.
The rollback loop incorrectly reuses the failing outer index i in every iteration, rather than the inner index j that tracks successfully registered vectors. As a result, pci_irq_vector() and the irq_vector table entry passed to free_irq() do not correspond to any registered handler.
This mismatch means free_irq() either returns an error or releases the wrong resource, while the actually registered handlers remain installed. The device is left in an inconsistent state with dangling interrupt handlers referencing driver structures that may later be freed.
Root Cause
The root cause is an indexing error in error-handling logic, a variant of improper resource cleanup. The rollback code was written to unwind handlers registered by the successful iterations, but the loop variable used for both pci_irq_vector() lookup and irq_vector array indexing was the failure index, not the rollback cursor.
Attack Vector
Exploitation requires local access with privileges sufficient to trigger driver initialization or induce MSI-X allocation failures. A local attacker who can influence resource pressure or module loading may cause the faulty rollback path to execute. The resulting stale interrupt handlers can produce use-after-free conditions when the driver structures are subsequently released, providing a primitive for kernel memory corruption and privilege escalation.
No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream fixes referenced under Kernel Git Commit 0205db7 and Kernel Git Commit f39e3ca for exact source-level details.
Detection Methods for CVE-2026-90007
Indicators of Compromise
- Kernel log messages from the pm8001 driver reporting request_irq() failures followed by free_irq() warnings about unregistered IRQs
- Unexpected SAS/SATA controller initialization failures on systems with PMC-Sierra host bus adapters
- Kernel oops or panic traces referencing pm8001_request_msix or MSI-X teardown paths
Detection Strategies
- Inventory hosts running kernels that include the vulnerable pm8001 driver and cross-reference against the fixed commit hashes
- Monitor dmesg and journalctl -k output for interrupt registration errors during boot or module reload events
- Correlate storage subsystem instability with recent module load activity or resource-pressure events
Monitoring Recommendations
- Forward kernel logs to a centralized logging system and alert on pm8001 error patterns and IRQ management warnings
- Track kernel module load events (init_module, finit_module) on systems with the affected driver
- Baseline expected SAS/SATA controller behavior and alert on deviations that could indicate exploitation attempts
How to Mitigate CVE-2026-90007
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the NVD entry as soon as vendor-supported builds are available
- Restrict local access and module loading privileges to trusted administrators only
- If the pm8001 driver is not required, blacklist the module to eliminate the attack surface entirely
Patch Information
The fix replaces the incorrect loop index in the rollback path so that both pci_irq_vector() and the irq_vector array reference j, the index of the last successfully registered handler. The patch is available across multiple stable branches via the upstream commits: Kernel Git Commit 0205db7, Kernel Git Commit 2853ce9, Kernel Git Commit 3f92a64, Kernel Git Commit a980dec, Kernel Git Commit dd81746, Kernel Git Commit e20b16a, Kernel Git Commit f39e3ca, and Kernel Git Commit fb22a8d. Consume the patch through your distribution's kernel update channel.
Workarounds
- Blacklist the pm8001 module on hosts that do not use PMC-Sierra SAS/SATA controllers to eliminate the vulnerable code path
- Enforce least privilege on module loading by restricting CAP_SYS_MODULE and disabling automatic module autoloading where feasible
- Enable kernel lockdown mode on production systems to reduce the attack surface exposed to local users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
