CVE-2026-64461 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, MediaTek PCI driver users, system administrators responsible for kernel updates and vulnerability management, and security teams should review and apply kernel patches, verify driver configurations, and monitor system logs to address potential issues related to the MediaTek PCI driver.

Why it matters

CVE-2026-64461 is a Linux kernel vulnerability in the MediaTek PCI driver that can lead to an IRQ domain leak when a port fails to enable. Defenders should review and apply kernel patches, verify driver configurations, and monitor system logs to address potential issues.

• Verify kernel patch application to prevent IRQ domain leaks
• Monitor system logs for potential issues related to the MediaTek PCI driver
• Review and update kernel configurations to ensure proper port enabling

Technical summary

The Linux kernel vulnerability, tracked as CVE-2026-64461, is related to an IRQ domain leak in the MediaTek PCI driver. When a port fails to enable, the IRQ domains set up earlier are not freed, leading to a potential resource leak. The issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC support series. Defenders should review and apply kernel patches, verify driver configurations, and monitor system logs to address potential issues. The vulnerability can be addressed by refactoring mtk_pcie_irq_teardown() into a per-port helper, mtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when mtk_pcie_enable_port() fails.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to address the IRQ domain leak vulnerability
• Verify the MediaTek PCI driver configuration and ensure proper port enabling
• Monitor system logs for potential issues related to the MediaTek PCI driver
• Perform a thorough review of the affected system to identify potential exposure
• Track exceptions and retest remediated assets to ensure the vulnerability is properly addressed
• Update asset inventory to reflect changes made to the system
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and NVD entry provide details on the Linux kernel vulnerability, while source references offer technical specifics on the MediaTek PCI driver issue. The issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC support series. The vulnerability can lead to a potential resource leak if not properly addressed. Defenders should review and apply kernel patches, verify driver configurations, and monitor system logs to address potential issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.