CVE-2026-90007
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001_request_msix() unwinds previously registered handlers with free_irq() when request_irq() fails. The rollback loop uses the failing index i for every iteration instead of the already registered vector index j. That passes the wrong IRQ/dev_id pair to free_irq() and leaves the earlier handlers installed. Use j for both pci_irq_vector() and the matching irq_vector entry in the rollback loop.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-16 11:17:13.323000
Last modified
2026-10-19 09:18:48.420000
View original CVE JSON
{
"id": "CVE-2026-90007",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-16T11:17:13.323",
"lastModified": "2026-10-19T09:18:48.420",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: pm8001: Use rollback index when freeing MSI-X vectors\n\npm8001_request_msix() unwinds previously registered handlers with\nfree_irq() when request_irq() fails. The rollback loop uses the failing\nindex i for every iteration instead of the already registered vector\nindex j.\n\nThat passes the wrong IRQ/dev_id pair to free_irq() and leaves the\nearlier handlers installed. Use j for both pci_irq_vector() and the\nmatching irq_vector entry in the rollback loop."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/scsi/pm8001/pm8001_init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "a76037ff3479ad333a2505061915f7a21e7f3fb6",
"lessThan": "f39e3ca1f688d7c08954a0794e9bf1e279c83b15",
"versionType": "git",
"status": "affected"
},
{
"version": "a76037ff3479ad333a2505061915f7a21e7f3fb6",
"lessThan": "a980dec7c69990e4f119bcf6a2ea093d1c4975e8",
"versionType": "git",
"status": "affected"
},
{
"version": "a76037ff3479ad333a2505061915f7a21e7f3fb6",
"lessThan": "0205db768570f9a46b20912afa581a0c7a63d8b7",
"versionType": "git",
"status": "affected"
},
{
"version": "a76037ff3479ad333a2505061915f7a21e7f3fb6",
"lessThan": "2853ce9c88e0e6dd575f95f28b3a8c2b27164115",
"versionType": "git",
"status": "affected"
},
{
"version": "a76037ff3479ad333a2505061915f7a21e7f3fb6",
"lessThan": "fb22a8d2f3ac6665cc8bee197096b6675cac1a9f",
"versionType": "git",
"status": "affected"
},
{
"version": "a76037ff3479ad333a2505061915f7a21e7f3fb6",
"lessThan": "dd817463c9b42a3a9e23d15b86c6c77a6cfb809d",
"versionType": "git",
"status": "affected"
},
{
"version": "a76037ff3479ad333a2505061915f7a21e7f3fb6",
"lessThan": "e20b16aa3b49f9db5510940740255a987e6f2a6f",
"versionType": "git",
"status": "affected"
},
{
"version": "a76037ff3479ad333a2505061915f7a21e7f3fb6",
"lessThan": "3f92a64545165bdbb36dee8fa35626b295463313",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/scsi/pm8001/pm8001_init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.11",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.11",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.270",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.221",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.188",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.157",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.110",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.51",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.5",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0205db768570f9a46b20912afa581a0c7a63d8b7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2853ce9c88e0e6dd575f95f28b3a8c2b27164115",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3f92a64545165bdbb36dee8fa35626b295463313",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a980dec7c69990e4f119bcf6a2ea093d1c4975e8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dd817463c9b42a3a9e23d15b86c6c77a6cfb809d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e20b16aa3b49f9db5510940740255a987e6f2a6f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/f39e3ca1f688d7c08954a0794e9bf1e279c83b15",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/fb22a8d2f3ac6665cc8bee197096b6675cac1a9f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}