Cloudanix VulnDB

CVE-2026-93072

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A driver cleanup problem in the Linux kernel can leave behind memory that later gets used incorrectly, occasionally causing the whole system to crash.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Memory leak of domain generic chips and associated structures on irqchip driver removal due to missing IRQ_DOMAIN_FLAG_DESTROY_GC, leaving stale entries on global lists that trigger use-after-free in generic chip suspend/resume/shutdown callbacks.

Why it matters to the business

Low-probability kernel instability or crash on driver unload or power events; minimal operational risk given zero known exploitation and flat low exploit probability over 37 days since disclosure.

How an attack unfolds

An attacker with local access unloads the renesas-irqc driver, then triggers power-management callbacks that walk the global generic-chip list, dereferencing freed structures and causing a kernel crash or potential escalation.

How to fix it

Apply the upstream kernel commit that sets IRQ_DOMAIN_FLAG_DESTROY_GC on the interrupt domain so irq_domain_remove automatically frees the chips; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Inspect the irq_domain allocation site for the DESTROY_GC flag; attempt module removal followed by suspend/resume cycles under memory debugging tools to confirm absence of leaks and UAF reports.

Typical attack path

  1. Obtain local code execution or module-unload privileges
  2. Unload or remove the irqchip driver module
  3. Trigger system suspend, resume, or shutdown path
  4. Force dereference of freed generic-chip structures

How to detect it

Review kernel logs for oops or panic traces referencing generic-chip callbacks after module removal; correlate with module unload timestamps in audit or dmesg records.

What your security team should do

  • Prioritize kernel updates on systems using renesas-irqc hardware within normal patch cycles
  • Monitor upstream stable branches for the backported fix
  • Include kernel module load/unload events in routine stability testing

The record

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-irqc: Fix generic interrupt chip leak on remove The driver allocates domain generic chips probe. However, on driver removal, the generic chips are not automatically freed when the interrupt domain is removed because the domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC. This causes both the domain generic chips structure and the associated generic chips to be leaked. Additionally, the generic chips remain on the global list and may later be accessed by generic interrupt chip suspend, resume, or shutdown callbacks after the driver has been removed, potentially resulting in a use-after-free and kernel crash. Fix the resource leak by setting IRQ_DOMAIN_FLAG_DESTROY_GC on the interrupt domain; this lets the interrupt domain core automatically release all generic chips when irq_domain_remove() is invoked, removing the need for manual cleanup calls in error paths and remove callback.

Affected packages

Ecosystem Package Introduced Fixed