{"cve":"CVE-2026-63862","nvd":{"published":"2026-07-19T15:16:53.097","modified":"2026-10-26T17:06:01.920","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found\n\nIn mtk_pcie_setup_irq(), the IRQ domains are allocated before the\ncontroller's IRQ is fetched. If the latter fails, the function\ndirectly returns an error, without cleaning up the allocated domains.\n\nHence, reverse the order so that the IRQ domains are allocated after the\ncontroller's IRQ is found.\n\nThis was flagged by Sashiko during a review of \"[PATCH v6 0/7] PCI:\nmediatek-gen3: add power control support\".","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/07a5ecb94768cbf76fe659e9924000e9ced0c8a6","https://git.kernel.org/stable/c/0a2d60edc3e57c9512e239ebdfd12204d3368560","https://git.kernel.org/stable/c/215d4273347b9010a9deae378b0df79c163f707d","https://git.kernel.org/stable/c/5573c44cb3fd01a9f62d569ae9ac870ef5f0e0ba","https://git.kernel.org/stable/c/946b31b5a699a2760ee52af0055e5ebf29c5f4cb"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-26T17:23:06.845895309+00:00"},"epss":{"cve":"CVE-2026-63862","score":0.00215,"percentile":0.11731,"date":"2026-10-26"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}