Strix
26.1K

CVE-2026-63862

UnknownEPSS 0.16%

Last modified

CVE-2026-63862 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtk_pcie_setup_irq(), the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without cleaning up the allocated domains. Hence, reverse the order so that the IRQ domains are allocated after the controller's IRQ is found. This was flagged by Sashiko during a review of "[PATCH v6 0/7] PCI: mediatek-gen3: add power control support".. EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtk_pcie_setup_irq(), the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without cleaning up the allocated domains. Hence, reverse the order so that the IRQ domains are allocated after the controller's IRQ is found. This was flagged by Sashiko during a review of "[PATCH v6 0/7] PCI: mediatek-gen3: add power control support".

Metrics

EPSS Probability
0.16%

5.7th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 814cceebba9b7d1306b8d49587ffb0e81f7b73af, < abd3c1927d33766aef39c4640880e3d2637429c2; >= 814cceebba9b7d1306b8d49587ffb0e81f7b73af, < 07a5ecb94768cbf76fe659e9924000e9ced0c8a6; >= 814cceebba9b7d1306b8d49587ffb0e81f7b73af, < 946b31b5a699a2760ee52af0055e5ebf29c5f4cb; >= 814cceebba9b7d1306b8d49587ffb0e81f7b73af, < 0a2d60edc3e57c9512e239ebdfd12204d3368560; >= 814cceebba9b7d1306b8d49587ffb0e81f7b73af, < 215d4273347b9010a9deae378b0df79c163f707d; >= 814cceebba9b7d1306b8d49587ffb0e81f7b73af, < 5573c44cb3fd01a9f62d569ae9ac870ef5f0e0ba
LinuxLinux5.13

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-63862?
In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtk_pcie_setup_irq(), the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without cleaning up the allocated domains. Hence, reverse the order so that the IRQ domains are allocated after the controller's IRQ is found. This was flagged by Sashiko during a review of "[PATCH v6 0/7] PCI: mediatek-gen3: add power control support".
How severe is CVE-2026-63862?
Severity scoring for CVE-2026-63862 is pending analysis. The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2026-63862?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-63862?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST