CVE-2026-72153

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

irqchip/crossbar: Use correct index in crossbar_domain_free()

crossbar_domain_free() resets the domain data and then uses the nulled

out irq_data->hwirq member as index to reset the irq_map[] entry and to

write the relevant crossbar register with a safe entry. That means it

never frees the correct index and keeps the crossbar register connection

to the source interrupt active.

If it would not reset the domain data, then this would be even worse as

irq_data->hwirq holds the source interrupt number, but both the map and

register index need the corresponding GIC SPI number and not the source

interrupt number. This might even result in an out of bounds access as

the source interrupt number can be higher than the maximal index space.

Fix this by using the GIC SPI index from the parent domain's irq_data.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References