Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-90007

scsi: pm8001: Use rollback index when freeing MSI-X vectors

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001_request_msix() unwinds previously registered handlers with free_irq() when request_irq() fails. The rollback loop uses the failing index i for every iteration instead of the already registered vector index j. That passes the wrong IRQ/dev_id pair to free_irq() and leaves the earlier handlers installed. Use j for both pci_irq_vector() and the matching irq_vector entry in the rollback loop.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From a76037ff3479ad333a2505061915f7a21e7f3fb6 · fixed in f39e3ca1f688d7c08954a0794e9bf1e279c83b15; From a76037ff3479ad333a2505061915f7a21e7f3fb6 · fixed in a980dec7c69990e4f119bcf6a2ea093d1c4975e8; From a76037ff3479ad333a2505061915f7a21e7f3fb6 · fixed in 0205db768570f9a46b20912afa581a0c7a63d8b7; From a76037ff3479ad333a2505061915f7a21e7f3fb6 · fixed in 2853ce9c88e0e6dd575f95f28b3a8c2b27164115; From a76037ff3479ad333a2505061915f7a21e7f3fb6 · fixed in fb22a8d2f3ac6665cc8bee197096b6675cac1a9f; From a76037ff3479ad333a2505061915f7a21e7f3fb6 · fixed in dd817463c9b42a3a9e23d15b86c6c77a6cfb809d; From a76037ff3479ad333a2505061915f7a21e7f3fb6 · fixed in e20b16aa3b49f9db5510940740255a987e6f2a6f; From a76037ff3479ad333a2505061915f7a21e7f3fb6 · fixed in 3f92a64545165bdbb36dee8fa35626b295463313

  • Linux Linux

    4.11

  • KernelLinux

    From 4.11.0 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.51; From 6.19.0 · fixed in 7.2.5

References 8

git.kernel.org