CVE-2026-72384

In the Linux kernel, the following vulnerability has been resolved:

irqchip/ts4800: Fix missing chained handler cleanup on remove

The driver installs a chained handler for the parent interrupt during probe using irqsetchainedhandlerand_data(), but the remove function does not clear this handler. This leaves a dangling handler that may be called when the parent interrupt fires after the driver has been removed, potentially accessing freed memory and causing a kernel crash.

Additionally, the parentirq obtained via irqofparseand_map() is not stored, making it inaccessible in the remove function. Moreover, interrupt mappings created during probe are not properly disposed.

Fix this by:

• Saving parent_irq in probe
• Clearing the chained handler with NULL in ts4800icremove()
• Disposing all IRQ mappings before domain removal to prevent resource leaks