CVE-2026-46141

In the Linux kernel, the following vulnerability has been resolved:

powerpc/xive: fix kmemleak caused by incorrect chip_data lookup

The kmemleak reports the following memory leak:

Unreferenced object 0xc0000002a7fbc640 (size 64): comm "kworker/8:1", pid 540, jiffies 4294937872 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 09 04 00 04 00 00 ................ 00 00 a7 81 00 00 0a c0 00 00 08 04 00 04 00 00 ................ backtrace (crc 177d48f6): __kmalloccachenoprof+0x520/0x730 xive_irqallocdata.constprop.0+0x40/0xe0 xiveirqdomainalloc+0xd0/0x1b0 irqdomainallocirqsparent+0x44/0x6c pseriesirqdomainalloc+0x1cc/0x354 irqdomainallocirqsparent+0x44/0x6c msidomainalloc+0xb0/0x220 irqdomainallocirqslocked+0x138/0x4d0 __irqdomainalloc_irqs+0x8c/0xfc __msidomainallocirqs+0x214/0x4d8 msidomainallocirqsalllocked+0x70/0xf8 pcimsisetupmsiirqs+0x60/0x78 __pcienablemsixrange+0x54c/0x98c pciallocirqvectorsaffinity+0x16c/0x1d4 nvmepcienable+0xac/0x9c0 [nvme] nvmeprobe+0x340/0x764 [nvme]

This occurs when allocating MSI-X vectors for an NVMe device. During allocation the XIVE code creates a struct xiveirqdata and stores it in irqdata->chipdata.

When the MSI-X irqdomain is later freed, xiveirqfreedata() is responsible for retrieving this structure and freeing it. However, after commit cc0cc23babc9 ("powerpc/xive: Untangle xive from child interrupt controller drivers"), xiveirqfreedata() retrieves the chipdata using irqgetchipdata(), which looks up the data through the child domain.

This is incorrect because the XIVE-specific irq data is associated with the XIVE (parent) domain. As a result the lookup fails and the allocated struct xiveirqdata is never freed, leading to the kmemleak report shown above.

Fix this by retrieving the irqdata from the correct domain using irqdomaingetirqdata() and then accessing the chipdata via irqdatagetirqchip_data().