Improper resource shutdown or release in Linux kernel - CVE-2026-46060
Published: May 28, 2026
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown in IRQ handler cleanup in the qat driver when handling a device probe failure after partial initialization. A local user can trigger a probe failure after adf_dev_up() partially completes to cause a denial of service.
The issue occurs because IRQ handlers can remain attached while MSI-X vectors are released during devres cleanup.
Affected software
Ubuntu
linux (Ubuntu package)
linux-realtime (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-aws (Ubuntu package)
linux-raspi (Ubuntu package)
linux-azure (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-ibm (Ubuntu package)
linux-azure-fde (Ubuntu package)
How to mitigate CVE-2026-46060
linux (Ubuntu package) - update to 7.0.0-27.27
linux-realtime (Ubuntu package) - update to 7.0.0-27.27.1
linux-gcp (Ubuntu package) - update to 7.0.0-1007.7
linux-oracle (Ubuntu package) - update to 7.0.0-1007.7
linux-aws (Ubuntu package) - update to 7.0.0-1008.8
linux-raspi (Ubuntu package) - update to 7.0.0-1014.14
linux-azure (Ubuntu package) - update to 7.0.0-1010.10
linux-nvidia (Ubuntu package) - update to 7.0.0-1013.13
linux-ibm (Ubuntu package) - update to 7.0.0-1009.9
linux-azure-fde (Ubuntu package) - update to 7.0.0-1009.9