{"id":"CVE-2026-46060","title":"crypto: qat - fix IRQ cleanup on 6xxx probe failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix IRQ cleanup on 6xxx probe failure\n\nWhen adf_dev_up() partially completes and then fails, the IRQ\nhandlers registered during adf_isr_resource_alloc() a…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 17fd7514ae68c541bf952876ce2005cb4a53f283 < 27f561bf894e46bdc2d6209c50884adad79d8277","Linux >= 17fd7514ae68c541bf952876ce2005cb4a53f283 < 7cd651f1357dcc477e6483c3a4706836b46bdc92","Linux >= 17fd7514ae68c541bf952876ce2005cb4a53f283 < 95aed2af87ec43fa7624cc81dd13d37824ad4972","Linux 6.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:06:52.538678Z"},"published":"2026-05-27","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:13:34.921Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46060","references":[{"url":"https://git.kernel.org/stable/c/27f561bf894e46bdc2d6209c50884adad79d8277"},{"url":"https://git.kernel.org/stable/c/7cd651f1357dcc477e6483c3a4706836b46bdc92"},{"url":"https://git.kernel.org/stable/c/95aed2af87ec43fa7624cc81dd13d37824ad4972"}],"tags":["cve.org"],"epss":0.00121,"epssPercentile":0.01906,"ingestedAt":"2026-11-06T16:57:43.346Z","slug":"CVE-2026-46060","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix IRQ cleanup on 6xxx probe failure\n\nWhen adf_dev_up() partially completes and then fails, the IRQ\nhandlers registered during adf_isr_resource_alloc() are not detached\nbefore the MSI-X vectors are released.\n\nSince the device is enabled with pcim_enable_device(), calling\npci_alloc_irq_vectors() internally registers pcim_msi_release() as a\ndevres action. On probe failure, devres runs pcim_msi_release() which\ncalls pci_free_irq_vectors(), tearing down the MSI-X vectors while IRQ\nhandlers (for example 'qat0-bundle0') are still attached. This causes\nremove_proc_entry() warnings:\n\n    [   22.163964] remove_proc_entry: removing non-empty directory 'irq/143', leaking at least 'qat0-bundle0'\n\nMoving the devm_add_action_or_reset() before adf_dev_up() does not solve\nthe problem since devres runs in LIFO order and pcim_msi_release(),\nregistered later inside adf_dev_up(), would still fire before\nadf_device_down().\n\nFix by calling adf_dev_down() explicitly when adf_dev_up() fails, to\nproperly free IRQ handlers before devres releases the MSI-X vectors.\n\n## Affected\n\n- `Linux >= 17fd7514ae68c541bf952876ce2005cb4a53f283 < 27f561bf894e46bdc2d6209c50884adad79d8277`\n- `Linux >= 17fd7514ae68c541bf952876ce2005cb4a53f283 < 7cd651f1357dcc477e6483c3a4706836b46bdc92`\n- `Linux >= 17fd7514ae68c541bf952876ce2005cb4a53f283 < 95aed2af87ec43fa7624cc81dd13d37824ad4972`\n- `Linux 6.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}