CVE-2026-90007

Summary

In the Linux kernel, the following vulnerability has been resolved:

scsi: pm8001: Use rollback index when freeing MSI-X vectors

pm8001_request_msix() unwinds previously registered handlers with free_irq() when request_irq() fails. The rollback loop uses the failing index i for every iteration instead of the already registered vector index j.

That passes the wrong IRQ/dev_id pair to free_irq() and leaves the earlier handlers installed. Use j for both pci_irq_vector() and the matching irq_vector entry in the rollback loop.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxa76037ff3479ad333a2505061915f7a21e7f3fb6 < f39e3ca1f688d7c08954a0794e9bf1e279c83b15affected
LinuxLinuxa76037ff3479ad333a2505061915f7a21e7f3fb6 < a980dec7c69990e4f119bcf6a2ea093d1c4975e8affected
LinuxLinuxa76037ff3479ad333a2505061915f7a21e7f3fb6 < 0205db768570f9a46b20912afa581a0c7a63d8b7affected
LinuxLinuxa76037ff3479ad333a2505061915f7a21e7f3fb6 < 2853ce9c88e0e6dd575f95f28b3a8c2b27164115affected
LinuxLinuxa76037ff3479ad333a2505061915f7a21e7f3fb6 < fb22a8d2f3ac6665cc8bee197096b6675cac1a9faffected
LinuxLinuxa76037ff3479ad333a2505061915f7a21e7f3fb6 < dd817463c9b42a3a9e23d15b86c6c77a6cfb809daffected
LinuxLinuxa76037ff3479ad333a2505061915f7a21e7f3fb6 < e20b16aa3b49f9db5510940740255a987e6f2a6faffected
LinuxLinuxa76037ff3479ad333a2505061915f7a21e7f3fb6 < 3f92a64545165bdbb36dee8fa35626b295463313affected
LinuxLinux4.11affected
LinuxLinux0 < 4.11unaffected
LinuxLinux5.10.270 <= 5.10.*unaffected
LinuxLinux5.15.221 <= 5.15.*unaffected
LinuxLinux6.1.188 <= 6.1.*unaffected
LinuxLinux6.6.157 <= 6.6.*unaffected
LinuxLinux6.12.110 <= 6.12.*unaffected
LinuxLinux6.18.51 <= 6.18.*unaffected
LinuxLinux7.2.5 <= 7.2.*unaffected
LinuxLinux7.3-rc2 <= *unaffected

Weaknesses

References