CVE-2026-89964 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
parisc: eisa: Fix infinite loop when parsing invalid IRQ value
When an invalid value is passed via the "eisa_irq_edge=" kernel command line parameter (e.g. "eisa_irq_edge=16,5"), eisa_irq_setup() prints an error message and continues without advancing the current position. As a result the same invalid value is parsed again and again, causing an infinite loop while the kernel boots.
Advance to the next comma-separated entry, or stop parsing when there is no next entry, before continuing so that the remaining entries are processed normally.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel's parisc architecture contains a critical flaw within the EISA interrupt handling subsystem specifically located in the eisa_irq_setup function. This vulnerability manifests as an infinite loop during system boot when invalid input is provided via the kernel command line parameter eisa_irq_edge. The root cause lies in the parsing logic which fails to advance the current position pointer after detecting and logging an error for a malformed IRQ value, such as "eisa_irq_edge=16,5". Instead of skipping over the erroneous entry or terminating the loop upon reaching the end of the input string, the function repeatedly attempts to parse the same invalid data. This results in a denial of service condition where the kernel becomes unresponsive during the initialization phase, effectively preventing the operating system from completing its boot sequence and rendering the affected hardware unusable until corrected.
From a technical perspective, this issue represents a classic logic error in input validation and state management within low-level kernel code. The failure to increment the parsing index or check for end-of-string conditions violates basic principles of robust string processing. In terms of industry standards, this vulnerability aligns with CWE-835 which describes loops that do not terminate due to missing exit conditions. Furthermore, because it involves improper handling of user-supplied input leading to a denial of service during system startup, it can be categorized under CWE-20 Improper Input Validation and potentially mapped to ATT&CK technique T1496 Resource Hijacking if exploited in a manner that consumes excessive CPU resources, although the primary impact here is localized boot failure rather than sustained resource exhaustion. The lack of bounds checking or progress tracking allows an attacker with access to modify kernel command line parameters, such as through bootloader configuration files like GRUB, to trigger this condition intentionally.
The operational impact of this vulnerability is severe for systems relying on EISA bus devices on parisc architecture platforms. Since the infinite loop occurs during early boot stages, it prevents the initialization of subsequent subsystems and drivers that depend on successful completion of hardware setup routines. Administrators may find themselves unable to access the system console or remote management interfaces because the kernel hangs before establishing network services or login prompts. This effectively bricks the machine from a software perspective until the command line parameters are manually corrected in the bootloader configuration, requiring physical access or out-of-band management capabilities that might not be available depending on the deployment environment.
Mitigation strategies primarily involve ensuring that all kernel boot parameters passed to the system adhere strictly to expected formats and value ranges. System administrators should audit their bootloader configurations for any custom eisa_irq_edge settings and validate them against documented specifications before applying updates or changing hardware configurations. For environments where such parameters are dynamically generated, input sanitization at the generation layer is essential to prevent malformed strings from reaching the kernel parser. Additionally, future patches to the Linux kernel address this by modifying the parsing logic in eisa_irq_setup to correctly advance the pointer past invalid entries and properly terminate when no further comma-separated values remain. Applying the latest available kernel updates for parisc architectures will resolve this issue by implementing these corrective measures, ensuring that malformed input results in a logged error and continued processing of valid subsequent parameters rather than an infinite loop.