Linux Kernel up to 6.18.26/7.0.3 IRQ adf_dev_up privilege escalation

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.18.26/7.0.3 and classified as critical. Affected by this vulnerability is the function adf_dev_up of the component IRQ Handler. The manipulation results in an unknown weakness. This vulnerability is known as CVE-2026-46060. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Linux Kernel up to 6.18.26/7.0.3. Affected is the function adf_dev_up of the component IRQ Handler. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix IRQ cleanup on 6xxx probe failure When adf_dev_up() partially completes and then fails, the IRQ handlers registered during adf_isr_resource_alloc() are not detached before the MSI-X vectors are released. Since the device is enabled with pcim_enable_device(), calling pci_alloc_irq_vectors() internally registers pcim_msi_release() as a devres action. On probe failure, devres runs pcim_msi_release() which calls pci_free_irq_vectors(), tearing down the MSI-X vectors while IRQ handlers (for example 'qat0-bundle0') are still attached. This causes remove_proc_entry() warnings: [ 22.163964] remove_proc_entry: removing non-empty directory 'irq/143', leaking at least 'qat0-bundle0' Moving the devm_add_action_or_reset() before adf_dev_up() does not solve the problem since devres runs in LIFO order and pcim_msi_release(), registered later inside adf_dev_up(), would still fire before adf_device_down(). Fix by calling adf_dev_down() explicitly when adf_dev_up() fails, to properly free IRQ handlers before devres releases the MSI-X vectors.

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2026-46060 since 05/13/2026. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/16/2026).

Upgrading to version 6.18.27, 7.0.4 or 7.1-rc1 eliminates this vulnerability. Applying the patch 27f561bf894e46bdc2d6209c50884adad79d8277/7cd651f1357dcc477e6483c3a4706836b46bdc92/95aed2af87ec43fa7624cc81dd13d37824ad4972 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.18.16
• 6.18.17
• 6.18.18
• 6.18.19
• 6.18.20
• 6.18.21
• 6.18.22
• 6.18.23
• 6.18.24
• 6.18.25
• 6.18.26
• 7.0.0
• 7.0.1
• 7.0.2
• 7.0.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion