Linux Kernel CVE-2026-63862

Exploitation requires local access to a system running the Linux mediatek-gen3 PCIe host-controller driver (CONFIG_PCIE_MEDIATEK_GEN3) on MediaTek SoC hardware, and the ability to drive the driver's probe (mtk_pcie_setup_irq()) down the specific error path where the controller's IRQ cannot be fetched - the point at which the already-allocated IRQ domains are leaked. Limiting factors are significant: the CVSS vector is AV:L/PR:L (local, authenticated - authentication/privilege required per PR:L, not remote), the affected code only runs on MediaTek PCIe Gen3 controllers, and the leak occurs only on a probe failure condition that is not attacker-controlled under normal operation, so repeated triggering typically needs privileged driver rebind/reload. There is no user-interaction requirement (UI:N) and the scope is unchanged (S:U).

This is a low-priority, high-CVSS-base-but-low-real-risk issue. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 5.5 (medium) and is driven entirely by an availability claim (A:H) with no confidentiality or integrity impact - consistent with the described defect, which is a kernel resource leak (IRQ domains not freed on an error path in mtk_pcie_setup_irq()). The exploitation signals all point to low real-world urgency: EPSS is 0.16% (6th percentile), there is no CISA KEV listing, and no public exploit code or PoC is present in the provided references (only stable-tree patch commits and vendor advisories). The vuln.today decision label is 'this_month', not act_now/emergency, which aligns with the weak exploitation signals. A notable conflict: the A:H rating implies a serious denial-of-service, but the defect is a one-time leak of IRQ domain allocations that only occurs when the controller's IRQ fetch fails during driver probe of a specific MediaTek PCIe Gen3 host controller - a condition an attacker cannot readily and repeatedly induce. The A:H therefore appears generous relative to the described mechanism. Additionally, the 'Information Disclosure' tag contradicts the vector (C:N), so it should not drive triage.

A local user with sufficient privileges to bind/unbind or reload the mediatek-gen3 PCIe host-controller driver on affected MediaTek hardware repeatedly forces the driver's probe routine down the error path where the controller IRQ is not found, each time leaking the previously allocated IRQ domains and slowly consuming kernel memory. No public exploit or PoC was identified for this issue, and no realistic remote vector exists given the local attack vector.