CVE-2026-92524: Linux kernel · irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in d324c4353f64190a032c78d6e07be6d57ddfb2f1 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 17:16 UTC
Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in d324c4353f64190a032c78d6e07be6d57ddfb2f1, c4643bcb3bdda96b7292d6ab6ed196755a5bc304, 325ff3e78c64cd619d52b99f7c8b09a3f31e1495 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in the Linux kernel. Users should update to a kernel version that includes the fix, identified by the provided commit hashes. No additional mitigation is required beyond applying the official patch.
Description
A resource leak vulnerability in the Linux kernel's irqchip/gic-v3-its component was fixed. The issue occurs when its_irq_gic_domain_alloc() fails, causing its_vpe_irq_domain_free() to skip invoking its_vpe_teardown(), which leads to resource leakage. The fix ensures its_vpe_teardown() is called in the error handling path to prevent this leak.
References
- git.kernel.org/stable/c/82bccf7f9a12bf0eec9774968f6a853020ea26d3 (opens in a new tab)
- git.kernel.org/stable/c/6cd7e9b5463e1bceddcaf4acec6ca0f12553455b (opens in a new tab)
- git.kernel.org/stable/c/05c199d6b806ed1cc64807062f9986f11315e8ab (opens in a new tab)
- git.kernel.org/stable/c/c4643bcb3bdda96b7292d6ab6ed196755a5bc304 (opens in a new tab)
- git.kernel.org/stable/c/0d1951a1935a11c197272dbd38349033f0ef8991 (opens in a new tab)
- git.kernel.org/stable/c/6eb1f1414bf70185dad2525ecac5411db551faa2 (opens in a new tab)
- git.kernel.org/stable/c/d324c4353f64190a032c78d6e07be6d57ddfb2f1 (opens in a new tab)
- git.kernel.org/stable/c/325ff3e78c64cd619d52b99f7c8b09a3f31e1495 (opens in a new tab)