Bug 2516741 (CVE-2026-72153)

Summary: CVE-2026-72153 kernel: irqchip/crossbar: Use correct index in crossbar_domain_free()
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's `irqchip/crossbar` component. The `crossbar_domain_free()` function incorrectly uses a nulled-out hardware interrupt (hwirq) member as an index when attempting to free domain data. This can lead to an out-of-bounds write when resetting an interrupt mapping entry or writing to a crossbar register. A local attacker could potentially exploit this vulnerability to cause memory corruption or a denial of service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:28:39 UTC 
In the Linux kernel, the following vulnerability has been resolved:

irqchip/crossbar: Use correct index in crossbar_domain_free()

crossbar_domain_free() resets the domain data and then uses the nulled
out irq_data->hwirq member as index to reset the irq_map[] entry and to
write the relevant crossbar register with a safe entry. That means it
never frees the correct index and keeps the crossbar register connection
to the source interrupt active.

If it would not reset the domain data, then this would be even worse as
irq_data->hwirq holds the source interrupt number, but both the map and
register index need the corresponding GIC SPI number and not the source
interrupt number. This might even result in an out of bounds access as
the source interrupt number can be higher than the maximal index space.

Fix this by using the GIC SPI index from the parent domain's irq_data.
Comment 1 Keith Grant 2026-08-18 13:11:27 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081534-CVE-2026-72153-1828@gregkh/T