GHSA-FMH8-WM6J-9MRF
Vulnerability from github – Published: 2026-09-17 18:32 – Updated: 2026-09-17 18:32In the Linux kernel, the following vulnerability has been resolved:
pinctrl: mediatek: free EINT resources on unbind
mtk_eint_do_init() creates an IRQ domain, populates it with a mapping for every EINT line and installs a chained handler on the parent interrupt, but none of these are ever released. This was harmless while the drivers were built-in, but now that they can be built as modules and unbound/rmmod'd it leaves behind a dangling IRQ domain, interrupt mappings whose chip data points at freed memory, and a chained handler that keeps firing into that freed data.
The plain allocations in mtk_eint_do_init() already use the device-managed devm_*() helpers, so tear the remaining resources down the same way: register a devm action that detaches the chained handler, waits for any in-flight handler to finish, disposes of the per-line mappings and removes the IRQ domain. This mirrors the device-managed lifecycle adopted for the GPIO chip and keeps the whole EINT setup self-cleaning on unbind.
{
"affected": [],
"aliases": [
"CVE-2026-92481"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:17:50Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mediatek: free EINT resources on unbind\n\nmtk_eint_do_init() creates an IRQ domain, populates it with a mapping for\nevery EINT line and installs a chained handler on the parent interrupt,\nbut none of these are ever released. This was harmless while the drivers\nwere built-in, but now that they can be built as modules and\nunbound/rmmod\u0027d it leaves behind a dangling IRQ domain, interrupt mappings\nwhose chip data points at freed memory, and a chained handler that keeps\nfiring into that freed data.\n\nThe plain allocations in mtk_eint_do_init() already use the device-managed\ndevm_*() helpers, so tear the remaining resources down the same way:\nregister a devm action that detaches the chained handler, waits for any\nin-flight handler to finish, disposes of the per-line mappings and removes\nthe IRQ domain. This mirrors the device-managed lifecycle adopted for the\nGPIO chip and keeps the whole EINT setup self-cleaning on unbind.",
"id": "GHSA-fmh8-wm6j-9mrf",
"modified": "2026-09-17T18:32:06Z",
"published": "2026-09-17T18:32:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92481"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/23252bc1cd9a58a039c9b1ae77b22d2b33da48e9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/51552c8c60d3b1fecc062eab2d8cfeaa1cb339dd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7f6d898179ca4771ee602bdad4246c3952af83eb"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/88292b7103d260e3e606eb3bb2794060a5fde48e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/903a7cdf63a81d3738594c5bd1b5955f58fda427"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e06785cba7f86d72abd531058b1a82d6952a7346"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.