CVE-2026-90123 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
irqchip/ast2700-intc: Avoid allocating in the irq_domain activate() callback
The interrupt core calls the irq_domain_activate() callback from __setup_irq() with desc->lock held and interrupts disabled. Both aspeed_intc1_irq_domain_activate() and aspeed_intc0_resolve_route() test a compatible string with fwnode_device_is_compatible().
fwnode_device_is_compatible() invokes fwnode_property_match_string(), which allocates with GFP_KERNEL. That's obviously not possible with interrupts disabled and a raw spinlock held.
Both call sites are only ever handed OF nodes, so use of_device_is_compatible() instead: it walks the property in place and does not allocate.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel interrupt controller driver for the Aspeed AST2700 SoC contained a critical concurrency violation within its irq_domain activation logic. The vulnerability arises from improper memory allocation context usage during interrupt setup operations, specifically involving the aspeed_intc1_irq_domain_activate and aspeed_intc0_resolve_route functions. These routines are invoked by the kernel's interrupt core subsystem through __setup_irq, which operates under strict constraints to maintain system stability and prevent deadlocks. During this phase of initialization, the desc->lock is held in a raw spinlock context, and hardware interrupts are globally disabled across all CPUs to ensure atomicity of the operation. This environment strictly prohibits operations that might sleep or trigger memory allocation with GFP_KERNEL flags, as such actions can lead to scheduling while holding locks or cause system hangs if no immediate free memory is available.
The technical flaw centers on the use of fwnode_device_is_compatible() within these activation callbacks. While this function serves its purpose of verifying device tree compatibility strings, it internally calls fwnode_property_match_string(), which performs dynamic memory allocation using GFP_KERNEL. In a context where interrupts are disabled and spinlocks are held, any attempt to allocate kernel memory is illegal because the allocator may need to sleep if memory pressure exists or if it needs to reclaim pages. Sleeping in this atomic context violates fundamental Linux kernel concurrency rules, potentially resulting in undefined behavior, system crashes, or severe performance degradation due to lock contention and scheduling anomalies. This represents a classic instance of sleeping function called from invalid context, a category of bugs that can be difficult to reproduce consistently but poses significant stability risks under load.
From an industry standards perspective, this vulnerability aligns with CWE-674, which describes Uncontrolled Recursion or Infinite Loop in the context of system resource exhaustion, though more accurately it maps to CWE-829: Inclusion of Functionality from Untrusted Control Sphere if viewed broadly as improper handling of kernel state. However, the most precise classification is related to improper locking and synchronization mechanisms often associated with race conditions and atomicity violations found in operating system kernels. The ATT&CK framework does not directly map internal kernel bugs like this unless they are exploited for privilege escalation or denial of service by a local attacker who can trigger specific interrupt configurations. Nevertheless, the exploitation potential lies in causing a Denial of Service against the entire system by triggering the illegal allocation during high-frequency interrupt setup scenarios, effectively freezing the CPU core handling the initialization until a timeout occurs or panic is triggered.
The operational impact of this vulnerability includes potential kernel panics, system freezes, and unpredictable behavior during device driver loading phases where these specific Aspeed interrupt controllers are initialized. Systems relying on the AST2700 platform could experience instability if multiple interrupts are configured rapidly or under memory-constrained conditions that force the allocator to sleep. This compromises the reliability of embedded systems using this SoC, particularly in industrial control environments where continuous uptime is critical. The flaw affects both INTC0 and INTC1 interrupt domains within the Aspeed architecture, meaning any software stack interacting with these hardware blocks during early boot or runtime reconfiguration could encounter issues if not patched.
The resolution involves replacing fwnode_device_is_compatible() with of_device_is_compatible(). This alternative function is designed specifically for Open Firmware device nodes and operates without dynamic memory allocation by walking the property data in place within the existing buffer structures provided by the device tree blob. Since both call sites are confirmed to only ever handle OF nodes, this substitution is safe and eliminates the illegal GFP_KERNEL allocation entirely. By avoiding heap access during atomic contexts, the driver adheres to kernel locking rules and ensures that interrupt setup proceeds without risking sleep conditions or lock violations. This fix restores proper concurrency handling within the irq_domain activation path, ensuring robust operation across varying memory pressure scenarios.
To mitigate similar issues in other drivers, developers must rigorously audit all code paths executed under spinlock-held or interrupts-disabled contexts for any calls to functions that may allocate memory with GFP_KERNEL or perform operations that might sleep. Static analysis tools and kernel testing frameworks such as Lockdep should be employed to detect sleeping-in-atomic-context violations early in the development cycle. Additionally, adhering strictly to device tree property access patterns that avoid dynamic allocation during critical sections is a best practice for maintaining system stability. For users of affected systems, applying the latest kernel updates containing this patch is essential to prevent potential denial-of-service conditions arising from improper interrupt controller initialization sequences on Aspeed AST2700-based hardware platforms.