GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-46141 (GCVE-0-2026-46141)

Vulnerability from cvelistv5 – Published: 2026-05-28 09:35 – Updated: 2026-06-14 17:57
VLAI
Title
powerpc/xive: fix kmemleak caused by incorrect chip_data lookup
Summary
In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: fix kmemleak caused by incorrect chip_data lookup The kmemleak reports the following memory leak: Unreferenced object 0xc0000002a7fbc640 (size 64): comm "kworker/8:1", pid 540, jiffies 4294937872 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 09 04 00 04 00 00 ................ 00 00 a7 81 00 00 0a c0 00 00 08 04 00 04 00 00 ................ backtrace (crc 177d48f6): __kmalloc_cache_noprof+0x520/0x730 xive_irq_alloc_data.constprop.0+0x40/0xe0 xive_irq_domain_alloc+0xd0/0x1b0 irq_domain_alloc_irqs_parent+0x44/0x6c pseries_irq_domain_alloc+0x1cc/0x354 irq_domain_alloc_irqs_parent+0x44/0x6c msi_domain_alloc+0xb0/0x220 irq_domain_alloc_irqs_locked+0x138/0x4d0 __irq_domain_alloc_irqs+0x8c/0xfc __msi_domain_alloc_irqs+0x214/0x4d8 msi_domain_alloc_irqs_all_locked+0x70/0xf8 pci_msi_setup_msi_irqs+0x60/0x78 __pci_enable_msix_range+0x54c/0x98c pci_alloc_irq_vectors_affinity+0x16c/0x1d4 nvme_pci_enable+0xac/0x9c0 [nvme] nvme_probe+0x340/0x764 [nvme] This occurs when allocating MSI-X vectors for an NVMe device. During allocation the XIVE code creates a struct xive_irq_data and stores it in irq_data->chip_data. When the MSI-X irqdomain is later freed, xive_irq_free_data() is responsible for retrieving this structure and freeing it. However, after commit cc0cc23babc9 ("powerpc/xive: Untangle xive from child interrupt controller drivers"), xive_irq_free_data() retrieves the chip_data using irq_get_chip_data(), which looks up the data through the child domain. This is incorrect because the XIVE-specific irq data is associated with the XIVE (parent) domain. As a result the lookup fails and the allocated struct xive_irq_data is never freed, leading to the kmemleak report shown above. Fix this by retrieving the irq_data from the correct domain using irq_domain_get_irq_data() and then accessing the chip_data via irq_data_get_irq_chip_data().
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cc0cc23babc979e399f34f53e4bccf702a389558 , < 2546fb8c9acc8c7512ed4339ce2a982cb7407065 (git)
Affected: cc0cc23babc979e399f34f53e4bccf702a389558 , < e66ed135cdf23a318e9727dca48f98f7f6142f78 (git)
Affected: cc0cc23babc979e399f34f53e4bccf702a389558 , < 6771c54728c278bf1e4bfdab4fddbbb186e33498 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.30 , ≤ 6.18.* (semver)
Unaffected: 7.0.7 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/sysdev/xive/common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2546fb8c9acc8c7512ed4339ce2a982cb7407065",
              "status": "affected",
              "version": "cc0cc23babc979e399f34f53e4bccf702a389558",
              "versionType": "git"
            },
            {
              "lessThan": "e66ed135cdf23a318e9727dca48f98f7f6142f78",
              "status": "affected",
              "version": "cc0cc23babc979e399f34f53e4bccf702a389558",
              "versionType": "git"
            },
            {
              "lessThan": "6771c54728c278bf1e4bfdab4fddbbb186e33498",
              "status": "affected",
              "version": "cc0cc23babc979e399f34f53e4bccf702a389558",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/sysdev/xive/common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/xive: fix kmemleak caused by incorrect chip_data lookup\n\nThe kmemleak reports the following memory leak:\n\nUnreferenced object 0xc0000002a7fbc640 (size 64):\n  comm \"kworker/8:1\", pid 540, jiffies 4294937872\n  hex dump (first 32 bytes):\n    01 00 00 00 00 00 00 00 00 00 09 04 00 04 00 00  ................\n    00 00 a7 81 00 00 0a c0 00 00 08 04 00 04 00 00  ................\n  backtrace (crc 177d48f6):\n    __kmalloc_cache_noprof+0x520/0x730\n    xive_irq_alloc_data.constprop.0+0x40/0xe0\n    xive_irq_domain_alloc+0xd0/0x1b0\n    irq_domain_alloc_irqs_parent+0x44/0x6c\n    pseries_irq_domain_alloc+0x1cc/0x354\n    irq_domain_alloc_irqs_parent+0x44/0x6c\n    msi_domain_alloc+0xb0/0x220\n    irq_domain_alloc_irqs_locked+0x138/0x4d0\n    __irq_domain_alloc_irqs+0x8c/0xfc\n    __msi_domain_alloc_irqs+0x214/0x4d8\n    msi_domain_alloc_irqs_all_locked+0x70/0xf8\n    pci_msi_setup_msi_irqs+0x60/0x78\n    __pci_enable_msix_range+0x54c/0x98c\n    pci_alloc_irq_vectors_affinity+0x16c/0x1d4\n    nvme_pci_enable+0xac/0x9c0 [nvme]\n    nvme_probe+0x340/0x764 [nvme]\n\nThis occurs when allocating MSI-X vectors for an NVMe device. During\nallocation the XIVE code creates a struct xive_irq_data and stores it\nin irq_data-\u003echip_data.\n\nWhen the MSI-X irqdomain is later freed, xive_irq_free_data() is\nresponsible for retrieving this structure and freeing it. However,\nafter commit cc0cc23babc9 (\"powerpc/xive: Untangle xive from child\ninterrupt controller drivers\"), xive_irq_free_data() retrieves the\nchip_data using irq_get_chip_data(), which looks up the data through\nthe child domain.\n\nThis is incorrect because the XIVE-specific irq data is associated with\nthe XIVE (parent) domain. As a result the lookup fails and the allocated\nstruct xive_irq_data is never freed, leading to the kmemleak report\nshown above.\n\nFix this by retrieving the irq_data from the correct domain using\nirq_domain_get_irq_data() and then accessing the chip_data via\nirq_data_get_irq_chip_data()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:57:33.523Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2546fb8c9acc8c7512ed4339ce2a982cb7407065"
        },
        {
          "url": "https://git.kernel.org/stable/c/e66ed135cdf23a318e9727dca48f98f7f6142f78"
        },
        {
          "url": "https://git.kernel.org/stable/c/6771c54728c278bf1e4bfdab4fddbbb186e33498"
        }
      ],
      "title": "powerpc/xive: fix kmemleak caused by incorrect chip_data lookup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46141",
    "datePublished": "2026-05-28T09:35:56.940Z",
    "dateReserved": "2026-05-13T15:03:33.100Z",
    "dateUpdated": "2026-06-14T17:57:33.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46141",
      "date": "2026-09-16",
      "epss": "0.00121",
      "percentile": "0.02159"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46141\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-28T10:16:29.680\",\"lastModified\":\"2026-06-24T17:08:28.837\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/xive: fix kmemleak caused by incorrect chip_data lookup\\n\\nThe kmemleak reports the following memory leak:\\n\\nUnreferenced object 0xc0000002a7fbc640 (size 64):\\n  comm \\\"kworker/8:1\\\", pid 540, jiffies 4294937872\\n  hex dump (first 32 bytes):\\n    01 00 00 00 00 00 00 00 00 00 09 04 00 04 00 00  ................\\n    00 00 a7 81 00 00 0a c0 00 00 08 04 00 04 00 00  ................\\n  backtrace (crc 177d48f6):\\n    __kmalloc_cache_noprof+0x520/0x730\\n    xive_irq_alloc_data.constprop.0+0x40/0xe0\\n    xive_irq_domain_alloc+0xd0/0x1b0\\n    irq_domain_alloc_irqs_parent+0x44/0x6c\\n    pseries_irq_domain_alloc+0x1cc/0x354\\n    irq_domain_alloc_irqs_parent+0x44/0x6c\\n    msi_domain_alloc+0xb0/0x220\\n    irq_domain_alloc_irqs_locked+0x138/0x4d0\\n    __irq_domain_alloc_irqs+0x8c/0xfc\\n    __msi_domain_alloc_irqs+0x214/0x4d8\\n    msi_domain_alloc_irqs_all_locked+0x70/0xf8\\n    pci_msi_setup_msi_irqs+0x60/0x78\\n    __pci_enable_msix_range+0x54c/0x98c\\n    pci_alloc_irq_vectors_affinity+0x16c/0x1d4\\n    nvme_pci_enable+0xac/0x9c0 [nvme]\\n    nvme_probe+0x340/0x764 [nvme]\\n\\nThis occurs when allocating MSI-X vectors for an NVMe device. During\\nallocation the XIVE code creates a struct xive_irq_data and stores it\\nin irq_data-\u003echip_data.\\n\\nWhen the MSI-X irqdomain is later freed, xive_irq_free_data() is\\nresponsible for retrieving this structure and freeing it. However,\\nafter commit cc0cc23babc9 (\\\"powerpc/xive: Untangle xive from child\\ninterrupt controller drivers\\\"), xive_irq_free_data() retrieves the\\nchip_data using irq_get_chip_data(), which looks up the data through\\nthe child domain.\\n\\nThis is incorrect because the XIVE-specific irq data is associated with\\nthe XIVE (parent) domain. As a result the lookup fails and the allocated\\nstruct xive_irq_data is never freed, leading to the kmemleak report\\nshown above.\\n\\nFix this by retrieving the irq_data from the correct domain using\\nirq_domain_get_irq_data() and then accessing the chip_data via\\nirq_data_get_irq_chip_data().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/powerpc/sysdev/xive/common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"cc0cc23babc979e399f34f53e4bccf702a389558\",\"lessThan\":\"2546fb8c9acc8c7512ed4339ce2a982cb7407065\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cc0cc23babc979e399f34f53e4bccf702a389558\",\"lessThan\":\"e66ed135cdf23a318e9727dca48f98f7f6142f78\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cc0cc23babc979e399f34f53e4bccf702a389558\",\"lessThan\":\"6771c54728c278bf1e4bfdab4fddbbb186e33498\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/powerpc/sysdev/xive/common.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.30\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.7\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.18\",\"versionEndExcluding\":\"6.18.30\",\"matchCriteriaId\":\"9EB9FADE-E22F-41C2-9790-4F5564D59E62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.7\",\"matchCriteriaId\":\"D0893CA7-9AE6-4DFE-AC75-48967D73AD8E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2546fb8c9acc8c7512ed4339ce2a982cb7407065\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6771c54728c278bf1e4bfdab4fddbbb186e33498\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e66ed135cdf23a318e9727dca48f98f7f6142f78\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T11:08:58+00:00",
      "cve": "CVE-2026-46141",
      "id": "CVE-2026-46141",
      "initial_release_date": "2026-05-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: powerpc/xive: fix kmemleak caused by incorrect chip_data lookup",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46141.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-06-15T01:23:13Z",
      "cve": "CVE-2026-46141",
      "id": "CVE-2026-46141",
      "initial_release_date": "2026-05-29T01:16:23Z",
      "product_status:known_not_affected": "291",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-46141",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-46141.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.