CVE-2026-92481

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: mediatek: free EINT resources on unbind

mtk_eint_do_init() creates an IRQ domain, populates it with a mapping for

every EINT line and installs a chained handler on the parent interrupt,

but none of these are ever released. This was harmless while the drivers

were built-in, but now that they can be built as modules and

unbound/rmmod'd it leaves behind a dangling IRQ domain, interrupt mappings

whose chip data points at freed memory, and a chained handler that keeps

firing into that freed data.

The plain allocations in mtk_eint_do_init() already use the device-managed

devm_*() helpers, so tear the remaining resources down the same way:

register a devm action that detaches the chained handler, waits for any

in-flight handler to finish, disposes of the per-line mappings and removes

the IRQ domain. This mirrors the device-managed lifecycle adopted for the

GPIO chip and keeps the whole EINT setup self-cleaning on

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References