---
id: CVE-2026-23013
title: 'net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback

  octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to
  ioq_vector. If request_irq() fails…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1cd3b407977c3ab1d2ddc26cb7113e7fb1509cd1 <
    aa05a8371ae4a452df623f7202c72409d3c50e40
  - >-
    Linux >= 1cd3b407977c3ab1d2ddc26cb7113e7fb1509cd1 <
    aa4c066229b05fc3d3c5f42693d25b1828533b6e
  - >-
    Linux >= 1cd3b407977c3ab1d2ddc26cb7113e7fb1509cd1 <
    f93fc5d12d69012788f82151bee55fce937e1432
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:06:24.345802Z'
published: '2026-01-25'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:49.078Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23013'
references:
  - url: 'https://git.kernel.org/stable/c/aa05a8371ae4a452df623f7202c72409d3c50e40'
  - url: 'https://git.kernel.org/stable/c/aa4c066229b05fc3d3c5f42693d25b1828533b6e'
  - url: 'https://git.kernel.org/stable/c/f93fc5d12d69012788f82151bee55fce937e1432'
tags:
  - cve.org
epss: 0.00175
epssPercentile: 0.06501
ingestedAt: '2026-10-16T17:24:46.638Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback

octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to
ioq_vector. If request_irq() fails part-way, the rollback loop calls
free_irq() with dev_id set to 'oct', which does not match the original
dev_id and may leave the irqaction registered.

This can keep IRQ handlers alive while ioq_vector is later freed during
unwind/teardown, leading to a use-after-free or crash when an interrupt
fires.

Fix the error path to free IRQs with the same ioq_vector dev_id used
during request_irq().

## Affected

- `Linux >= 1cd3b407977c3ab1d2ddc26cb7113e7fb1509cd1 < aa05a8371ae4a452df623f7202c72409d3c50e40`
- `Linux >= 1cd3b407977c3ab1d2ddc26cb7113e7fb1509cd1 < aa4c066229b05fc3d3c5f42693d25b1828533b6e`
- `Linux >= 1cd3b407977c3ab1d2ddc26cb7113e7fb1509cd1 < f93fc5d12d69012788f82151bee55fce937e1432`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.