CVE-2026-89455

A flaw was found in the Linux kernel's PCI PLDA driver. During the teardown of Interrupt Request (IRQ) domains, the system can attempt to access memory that has already been freed. This 'use-after-free' vulnerability occurs because the domain's internal data is released before all associated IRQs are properly deallocated. This can lead to system instability or crashes.

A moderate use-after-free flaw was found in the Linux kernel's PCI PLDA controller driver. During interrupt teardown, plda_pcie_irq_domain_deinit() removes the event IRQ domain via irq_domain_remove() while per-event IRQs requested with devm_request_irq() are still mapped into it; because the devm-deferred free_irq() only runs after probe()/remove() returns, devres can later dereference the already-freed domain. A local user with the ability to trigger the driver's teardown path (for example, unbinding or removing a PLDA-based PCIe controller device) could use this flaw to crash the kernel, resulting in a denial of service. Red Hat rates this flaw Moderate (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Earlier Red Hat Enterprise Linux releases (RHEL 6, 7, 8, and 9) and OpenShift 4 RHCOS builds do not contain this driver code and are therefore not affected. Red Hat Enterprise Linux 10 and OpenShift releases that ship a kernel containing the vulnerable PLDA PCIe code are affected, with the fix currently deferred. Residual risk is limited because triggering the flaw requires local privileged access to a system that reaches the driver's interrupt-domain teardown path on affected hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.