Medium 5.5Published Jul 19, 2026

CVE-2026-63862PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found

Updated under an hour ago (Oct 28, 2026, 6:30 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found In mtk_pcie_setup_irq(), the IRQ domains are allocated before the controller's IRQ is fetched. If the latter fails, the function directly returns an error, without cleaning up the allocated domains. Hence, reverse the order so that the IRQ domains are allocated after the controller's IRQ is found. This was flagged by Sashiko during a review of "[PATCH v6 0/7] PCI: mediatek-gen3: add power control support".

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jul 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 814cceebba9b7d1306b8d49587ffb0e81f7b73af before abd3c1927d33766aef39c4640880e3d2637429c2; 814cceebba9b7d1306b8d49587ffb0e81f7b73af builds before 07a5ecb94768cbf76fe659e9924000e9ced0c8a6; from 814cceebba9b7d1306b8d49587ffb0e81f7b73af before 946b31b5a699a2760ee52af0055e5ebf29c5f4cb; 814cceebba9b7d1306b8d49587ffb0e81f7b73af builds before 0a2d60edc3e57c9512e239ebdfd12204d3368560; 814cceebba9b7d1306b8d49587ffb0e81f7b73af builds before 215d4273347b9010a9deae378b0df79c163f707d; from 814cceebba9b7d1306b8d49587ffb0e81f7b73af before 5573c44cb3fd01a9f62d569ae9ac870ef5f0e0ba	CNA record
linux linux_kernel linux:linux_kernel	from 5.13 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10	NVD

References

References

https://git.kernel.org/stable/c/abd3c1927d33766aef39c4640880e3d2637429c2	patch
https://git.kernel.org/stable/c/07a5ecb94768cbf76fe659e9924000e9ced0c8a6	patch
https://git.kernel.org/stable/c/946b31b5a699a2760ee52af0055e5ebf29c5f4cb	patch
https://git.kernel.org/stable/c/0a2d60edc3e57c9512e239ebdfd12204d3368560	patch
https://git.kernel.org/stable/c/215d4273347b9010a9deae378b0df79c163f707d	patch
https://git.kernel.org/stable/c/5573c44cb3fd01a9f62d569ae9ac870ef5f0e0ba	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.