HighFix available
scsi: pm8001: Use rollback index when freeing MSI-X vectors
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001_request_msix() unwinds previously registered handlers with free_irq() when request_irq() fails. The rollback loop uses the failing index i for every iteration instead of the already registered vector index j. That passes the wrong IRQ/dev_id pair to free_irq() and leaves the earlier handlers installed. Use j for both pci_irq_vector() and the matching irq_vector entry in the rollback loop.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.270, 5.15.221, 6.1.188, 6.12.110, 6.18.51, 6.6.157, 7.2.5
- CVEs
- CVE-2026-90007
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 13:24 UTC · Revision 1
Source evidence
scsi: pm8001: Use rollback index when freeing MSI-X vectors
core-osv · Original sourcePublished 16 Sept 2026, 10:33 UTC
In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001_request_msix() unwinds previously registered handlers with free_irq() when request_irq() fails. The rollback loop uses the failing index i for every iteration instead of the already registered vector index j. That passes the wrong IRQ/dev_id pair to free_irq() and leaves the earlier handlers installed. Use j for both pci_irq_vector() and the matching irq_vector entry in the rollback loop.
osv:CVE-2026-90007
Kernel
Fixed versions: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5
Complete source record
{
"id": "dc4f3700b5f4eeff91ed6d8f5eb7364769e6f38298b33bea49b05a795f3e3b41",
"url": "https://osv.dev/vulnerability/CVE-2026-90007",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "scsi: pm8001: Use rollback index when freeing MSI-X vectors",
"summary": "In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Use rollback index when freeing MSI-X vectors pm8001_request_msix() unwinds previously registered handlers with free_irq() when request_irq() fails. The rollback loop uses the failing index i for every iteration instead of the already registered vector index j. That passes the wrong IRQ/dev_id pair to free_irq() and leaves the earlier handlers installed. Use j for both pci_irq_vector() and the matching irq_vector entry in the rollback loop.",
"evidence": "osv:CVE-2026-90007",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.270",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.221",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.188",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.157",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.110",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.51",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.5",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2026-90007",
"aliases": [
"CVE-2026-90007"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "a76037ff3479ad333a2505061915f7a21e7f3fb6"
},
{
"fixed": "f39e3ca1f688d7c08954a0794e9bf1e279c83b15"
},
{
"fixed": "a980dec7c69990e4f119bcf6a2ea093d1c4975e8"
},
{
"fixed": "0205db768570f9a46b20912afa581a0c7a63d8b7"
},
{
"fixed": "2853ce9c88e0e6dd575f95f28b3a8c2b27164115"
},
{
"fixed": "fb22a8d2f3ac6665cc8bee197096b6675cac1a9f"
},
{
"fixed": "dd817463c9b42a3a9e23d15b86c6c77a6cfb809d"
},
{
"fixed": "e20b16aa3b49f9db5510940740255a987e6f2a6f"
},
{
"fixed": "3f92a64545165bdbb36dee8fa35626b295463313"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90007.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.11.0"
},
{
"fixed": "5.10.270"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.221"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.188"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.157"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.110"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.51"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.5"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90007.json"
}
}
],
"modified": "2026-10-28T02:30:35.673404027Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/0205db768570f9a46b20912afa581a0c7a63d8b7",
"https://git.kernel.org/stable/c/2853ce9c88e0e6dd575f95f28b3a8c2b27164115",
"https://git.kernel.org/stable/c/3f92a64545165bdbb36dee8fa35626b295463313",
"https://git.kernel.org/stable/c/a980dec7c69990e4f119bcf6a2ea093d1c4975e8",
"https://git.kernel.org/stable/c/dd817463c9b42a3a9e23d15b86c6c77a6cfb809d",
"https://git.kernel.org/stable/c/e20b16aa3b49f9db5510940740255a987e6f2a6f",
"https://git.kernel.org/stable/c/f39e3ca1f688d7c08954a0794e9bf1e279c83b15",
"https://git.kernel.org/stable/c/fb22a8d2f3ac6665cc8bee197096b6675cac1a9f",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90007.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-90007",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90007.json"
}
},
"related_cves": [
{
"value": "CVE-2026-90007",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 503045,
"published_at": "2026-09-16T10:33:16.098+00:00"
}