CVE-2026-90007

The Linux kernel's pm8001 driver (PMC/Microchip PM8001/PM80xx SAS/SATA HBA controllers) contains an error-handling flaw in pm8001_request_msix(): when request_irq() fails during MSI-X vector registration, the rollback loop frees vectors using the failing index i instead of the already-registered index j. This passes the wrong IRQ/dev_id pair to free_irq(), so earlier successfully registered interrupt handlers are left installed with mismatched vector entries. The bug is only triggered on systems where the pm8001 driver loads on PM8001/PM80xx hardware and the MSI-X request path fails mid-registration, e.g. due to interrupt allocation exhaustion. A local attacker with low privileges could potentially influence IRQ allocation to reach this path, and the leftover handlers can lead to crashes or undefined behavior; the CVSS 7.8 score reflects high confidentiality, integrity and availability impact. No public proof-of-concept exists, the issue is not listed in CISA's KEV, and no exploitation is known.

What to do: Update the kernel to a version that includes the pm8001 rollback-index fix (watch stable-tree backports of the 'scsi: pm8001: Use rollback index when freeing MSI-X vectors' commit, since exact fixed version numbers are not provided in the data). Check whether the driver is in use with 'lsmod | grep pm8001' — systems without PM8001/PM80xx HBA hardware or with the module unloaded are not affected. There is no runtime workaround; standard hardening (restricting local unprivileged access on storage servers) reduces any chance of influencing the IRQ-failure path.