{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-64461",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-64461"
  ],
  "published": "2026-07-25T08:51:45Z",
  "summary": "PCI: mediatek: Fix IRQ domain leak when port fails to enable",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: mediatek: Fix IRQ domain leak when port fails to enable\n\nWhen mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port\nfrom pcie->ports and frees the port structure. However, the IRQ domains set\nup earlier by mtk_pcie_init_irq_domain() are never freed.\n\nFix this by refactoring mtk_pcie_irq_teardown() into a per-port helper,\nmtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when\nmtk_pcie_enable_port() fails. Since the IRQ teardown must only happen in\nthe probe error path (during resume, child devices may have active MSI\nmappings and the NOIRQ context prohibits sleeping locks),\nmtk_pcie_enable_port() is changed to return an error code so callers can\ndistinguish the two paths and act accordingly.\n\nThis issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC\nsupport series.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.178",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64461"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/e23da72ef202654a7d5269885c4fa39a8404db76"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ec7c05eed47d8b15c45380aee7ca168a82e15035"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1fbe8972a39548a633d06d7b03a01b7b119a2c12"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/fe8c701a53c2816cd82301f66c671d952003c1b0"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ce52e494a7555bdae1d990a2654fd7547ef6d986"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6e6a529d6f779413379b4404c9ef6a36c0337225"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/df77314b3bedbd9ad5d6f0682f98b99e3c5f7e2e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f865a57896bd92d7662eb2818d8f48872e2cbbc7"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-17T05:24:08Z"
  }
}