CVE-2026-46141

Technical summary

CVE-2026-46141 is a memory leak (CWE-401) in the PowerPC XIVE interrupt controller subsystem. The vulnerability stems from an incorrect chip_data lookup in xive_irq_free_data() introduced after commit cc0cc23babc9. When MSI-X interrupt domains are freed, the function uses irq_get_chip_data() to retrieve XIVE-specific interrupt data, but this API searches the child domain hierarchy rather than the parent XIVE domain where the data was stored during allocation. As a result, the xive_irq_data structure allocated during irq_domain_alloc is never freed. The fix involves using irq_domain_get_irq_data() to access the correct domain context and irq_data_get_irq_chip_data() to retrieve the chip data from the proper irq_data structure.

Business impact

This vulnerability primarily affects PowerPC-based systems using the XIVE interrupt controller—such as IBM POWER systems—that deploy NVMe storage devices. The memory leak compounds with each MSI-X device allocation, potentially causing gradual memory exhaustion and performance degradation over time, especially in data center environments with frequent device hot-swapping or virtualized workloads. While not immediately catastrophic, sustained operation could lead to system instability and service interruptions. The impact is limited to PowerPC architectures and does not affect x86 or ARM systems.

Affected systems

Linux kernel running on PowerPC processors that use the XIVE interrupt controller, particularly when NVMe devices are attached and MSI-X vectors are allocated. This includes IBM POWER8, POWER9, and POWER10 systems. The vulnerability does not affect other processor architectures (x86, ARM, etc.) or systems using alternative interrupt controllers.

Exploitability

This is not an exploitable vulnerability in the traditional sense. It is a memory management bug that cannot be leveraged for code execution, privilege escalation, or information disclosure. An unprivileged local user could potentially trigger the leak by repeatedly attaching and detaching NVMe devices if they have physical access or appropriate virtualization permissions, but no active exploitation method exists. The vulnerability is self-contained within kernel memory management and poses no direct security threat—only a reliability and resource availability risk.

Remediation

Apply the kernel patch that corrects the chip_data lookup in xive_irq_free_data() to use the proper domain context. Verify the fix against your Linux distribution's kernel advisory, as the patch version will depend on your release cycle. For systems unable to patch immediately, limit the frequency of MSI-X device attach/detach operations to minimize cumulative memory leak impact.

Patch guidance

Monitor your Linux distribution's security advisory channels and kernel repositories for the backported fix. For RHEL, Fedora, Ubuntu, and other major distributions, check their respective kernel security advisories referencing CVE-2026-46141. Apply the patch during a scheduled maintenance window, as kernel updates require a reboot. Verify the patch is included in your kernel's release notes before deployment. If you maintain custom kernel builds, ensure the fix from the Linux kernel mainline is incorporated into your build process.

Detection guidance

Monitor system memory usage trends on PowerPC systems with attached NVMe devices, particularly looking for unexplained gradual memory consumption over time. Use kmemleak reporting (if enabled in kernel config) to confirm xive_irq_data allocations without corresponding frees. In production, enable memory pressure monitoring and alerting on systems where MSI-X devices are routinely added or removed. Correlation of memory leaks with NVMe device attachment/detachment cycles on PowerPC architecture is a strong indicator of this vulnerability.

Why prioritize this

Although rated MEDIUM severity due to its confidentiality/integrity impact score of 0, the vulnerability merits prompt but not emergency patching. It affects a specific hardware subset (PowerPC + XIVE + NVMe) that is less common in typical enterprise environments but critical in specialized deployments like IBM Power Systems data centers. The cumulative nature of the memory leak makes earlier patching preferable to prevent long-term system degradation. Prioritize systems with high MSI-X device churn or constrained memory budgets.

Risk score, explained

The CVSS 3.1 score of 5.5 MEDIUM reflects a local attack vector requiring user privileges, no special access complexity, and impact limited to availability through resource exhaustion (memory leak). There is no direct impact to confidentiality or integrity. The score appropriately captures that this is a reliability issue rather than a security breach vector, but the cumulative nature of memory leaks warrants timely remediation to prevent production outages.

Frequently asked questions