CVE-2026-46060
published 2026-05-27CVE-2026-46060: In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix IRQ cleanup on 6xxx probe failure When adf_dev_up() partially completes…
medium5.5
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - fix IRQ cleanup on 6xxx probe failure
When adf_dev_up() partially completes and then fails, the IRQ
handlers registered during adf_isr_resource_alloc() are not detached
before the MSI-X vectors are released.
Since the device is enabled with pcim_enable_device(), calling
pci_alloc_irq_vectors() internally registers pcim_msi_release() as a
devres action. On probe failure, devres runs pcim_msi_release() which
calls pci_free_irq_vectors(), tearing down the MSI-X vectors while IRQ
handlers (for example 'qat0-bundle0') are still attached. This causes
remove_proc_entry() warnings:
[ 22.163964] remove_proc_entry: removing non-empty directory 'irq/143', leaking at least 'qat0-bundle0'
Moving the devm_add_action_or_reset() before adf_dev_up() does not solve
the problem since devres runs in LIFO order and pcim_msi_release(),
registered later inside adf_dev_up(), would still fire before
adf_device_down().
Fix by calling adf_dev_down() explicitly when adf_dev_up() fails, to
properly free IRQ handlers before devres releases the MSI-X vectors.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 17fd7514ae68c541bf952876ce2005cb4a53f283 < 27f561bf894e46bdc2d6209c50884adad79d8277 | 27f561bf894e46bdc2d6209c50884adad79d8277 |
| linux | linux | >= 17fd7514ae68c541bf952876ce2005cb4a53f283 < 7cd651f1357dcc477e6483c3a4706836b46bdc92 | 7cd651f1357dcc477e6483c3a4706836b46bdc92 |
| linux | linux | >= 17fd7514ae68c541bf952876ce2005cb4a53f283 < 95aed2af87ec43fa7624cc81dd13d37824ad4972 | 95aed2af87ec43fa7624cc81dd13d37824ad4972 |
| linux | linux_kernel | — | — |