---
id: CVE-2026-46060
title: 'crypto: qat - fix IRQ cleanup on 6xxx probe failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: qat - fix IRQ cleanup on 6xxx probe failure

  When adf_dev_up() partially completes and then fails, the IRQ
  handlers registered during adf_isr_resource_alloc() a…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 17fd7514ae68c541bf952876ce2005cb4a53f283 <
    27f561bf894e46bdc2d6209c50884adad79d8277
  - >-
    Linux >= 17fd7514ae68c541bf952876ce2005cb4a53f283 <
    7cd651f1357dcc477e6483c3a4706836b46bdc92
  - >-
    Linux >= 17fd7514ae68c541bf952876ce2005cb4a53f283 <
    95aed2af87ec43fa7624cc81dd13d37824ad4972
  - Linux 6.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:06:52.538678Z'
published: '2026-05-27'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:13:34.921Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46060'
references:
  - url: 'https://git.kernel.org/stable/c/27f561bf894e46bdc2d6209c50884adad79d8277'
  - url: 'https://git.kernel.org/stable/c/7cd651f1357dcc477e6483c3a4706836b46bdc92'
  - url: 'https://git.kernel.org/stable/c/95aed2af87ec43fa7624cc81dd13d37824ad4972'
tags:
  - cve.org
epss: 0.00121
epssPercentile: 0.01906
ingestedAt: '2026-11-06T16:57:43.346Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - fix IRQ cleanup on 6xxx probe failure

When adf_dev_up() partially completes and then fails, the IRQ
handlers registered during adf_isr_resource_alloc() are not detached
before the MSI-X vectors are released.

Since the device is enabled with pcim_enable_device(), calling
pci_alloc_irq_vectors() internally registers pcim_msi_release() as a
devres action. On probe failure, devres runs pcim_msi_release() which
calls pci_free_irq_vectors(), tearing down the MSI-X vectors while IRQ
handlers (for example 'qat0-bundle0') are still attached. This causes
remove_proc_entry() warnings:

    [   22.163964] remove_proc_entry: removing non-empty directory 'irq/143', leaking at least 'qat0-bundle0'

Moving the devm_add_action_or_reset() before adf_dev_up() does not solve
the problem since devres runs in LIFO order and pcim_msi_release(),
registered later inside adf_dev_up(), would still fire before
adf_device_down().

Fix by calling adf_dev_down() explicitly when adf_dev_up() fails, to
properly free IRQ handlers before devres releases the MSI-X vectors.

## Affected

- `Linux >= 17fd7514ae68c541bf952876ce2005cb4a53f283 < 27f561bf894e46bdc2d6209c50884adad79d8277`
- `Linux >= 17fd7514ae68c541bf952876ce2005cb4a53f283 < 7cd651f1357dcc477e6483c3a4706836b46bdc92`
- `Linux >= 17fd7514ae68c541bf952876ce2005cb4a53f283 < 95aed2af87ec43fa7624cc81dd13d37824ad4972`
- `Linux 6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.