CVE-2026-90121

A flaw was found in the Linux kernel's irqchip/gic-v5 component. During the setup or teardown of Interrupt Routing System (IRS) affinity, the system may fail to properly clear pointers to freed memory. This can result in central processing units (CPUs) attempting to access memory that has already been released, potentially leading to system instability or a denial of service (DoS).

A use-after-free flaw in the Linux kernel's irqchip/gic-v5 driver is rated Moderate by Red Hat Product Security. During Interrupt Routing System (IRS) affinity setup, an IRS pointer and IAFFID state are published in the per-CPU data before the remaining IRS initialization can fail; the error path then frees the IRS data without clearing that published state, and the same stale per-CPU association is left behind on normal IRS teardown. As a result, CPUs can remain associated with freed memory. A local user with low privileges able to trigger the affected IRS setup or teardown path on systems using the GIC-v5 interrupt controller could cause the kernel to access freed memory, leading to system instability or a kernel panic and consequently a denial of service. The flaw affects availability only; there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 6, 7, 8, and 9, as well as the RHEL CoreOS-based OpenShift Container Platform releases, are not affected because the vulnerable code is not present in their kernels. The kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 is affected, and the fix for those streams has been deferred to a future update. Given the local attack requirements and the availability-only impact of this flaw, the residual risk is that a local actor on an affected system could trigger a kernel panic and deny service to the machine.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.