CVE-2026-63798 Linux CVE debrief

Who should care

Linux kernel maintainers, developers, and users relying on the irqchip/imgpdc driver should be aware of this vulnerability and apply the fix to prevent potential crashes. Additionally, security teams and operators managing Linux-based systems should review the affected scope and implement compensating controls if necessary.

Technical summary

The irqchip/imgpdc driver in the Linux kernel had a resource leak vulnerability. During probe, it allocated domain generic chips using irq_alloc_domain_generic_chips() and set up chained handlers with irq_set_chained_handler_and_data(). However, on driver removal, the generic chips weren't freed and chained handlers weren't removed. This could lead to use-after-free and kernel crashes when generic interrupt chip suspend, resume, or shutdown callbacks accessed the chips after driver removal. The fix involves setting IRQ_DOMAIN_FLAG_DESTROY_GC in domain->flags so the core code automatically removes generic chips when irq_domain_remove() is called, and clearing all chained handlers with NULL in pdc_intc_remove().

Defensive priority

High priority for Linux kernel maintainers and developers using the irqchip/imgpdc driver.

Recommended defensive actions

• Apply the fix by setting IRQ_DOMAIN_FLAG_DESTROY_GC and clearing chained handlers
• Review and update Linux kernel configurations to ensure the fix is applied
• Monitor system logs for potential crashes or use-after-free errors
• Perform a thorough review of system configurations and deployment to identify potential exposure
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from the Linux kernel source code and commit history indicates a resource leak vulnerability in the irqchip/imgpdc driver. The fix has been applied to the Linux kernel stable branches. However, the exact scope of affected systems and potential exploitation attempts are not publicly known. Defenders should verify system configurations, review logs for suspicious activity, and ensure the fix is applied.

Official resources