VulnerabilityPublished 19 Jul 2026

CVE-2026-63862: Linux kernel · PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found

Affects Linux kernelSource GCVE Database

Not known to be exploited.

Data as of 26 Oct 2026, 18:42 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Exploitation evidence

Disclosed: evidence found.
CVE published 19 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

A fix has been implemented in the Linux kernel to reverse the order of IRQ domain allocation and IRQ fetching in the mediatek-gen3 PCI driver. Users should update to the fixed Linux kernel version containing this patch once it is released. No additional mitigation steps are indicated.

Description

A vulnerability in the Linux kernel's mediatek-gen3 PCI driver could lead to leaking IRQ domains if the IRQ is not found during initialization. The issue arises because IRQ domains are allocated before confirming the controller's IRQ, and if fetching the IRQ fails, the allocated domains are not cleaned up. This has been fixed by changing the order of operations to allocate IRQ domains only after successfully finding the controller's IRQ.

Impact

The vulnerability causes leaking of IRQ domains when the controller's IRQ is not found, potentially leading to resource exhaustion or instability in the kernel's PCI subsystem. There is no indication of direct security compromise such as privilege escalation or code execution. No known exploits in the wild have been reported.

Summary

CVE-2026-63862 addresses a resource leak in the Linux kernel's mediatek-gen3 PCI driver. Specifically, in the function mtk_pcie_setup_irq(), IRQ domains were allocated before the controller's IRQ was fetched. If fetching the IRQ failed, the function returned an error without releasing the allocated IRQ domains, causing a leak. The fix involves reversing the order so that IRQ domains are allocated only after the controller's IRQ is successfully obtained. This vulnerability was identified during a code review of power control support patches for the mediatek-gen3 PCI driver.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 26 Oct 2026, 18:42 UTC

Technical details

References

Community reviews

Related threats