CVE-2026-53226: gpio: rockchip: fix generic IRQ chip leak on remove

Q: What conditions are required to trigger the crash risk?

The Rockchip GPIO driver must first be removed or torn down. A later generic IRQ chip suspend, resume, or shutdown callback can then visit the stale generic chip entry and potentially access freed GPIO-bank memory, causing a kernel crash.

Q: Is this remotely exploitable?

The supplied CVSS vector identifies local attack access with low privileges and no user interaction. The described impact is availability only: a potential kernel crash; no confidentiality or integrity impact is specified.

Q: What is the mitigation if the fix cannot be applied immediately?

Avoid removing or tearing down the affected Rockchip GPIO driver, particularly before system suspend, resume, or shutdown operations. The described fix is to remove the domain's generic IRQ chips before removing the IRQ domain.

Q: How can I determine whether a system contains the fix?

Check whether rockchip_gpio_remove() explicitly calls irq_domain_remove_generic_chips() before it removes the IRQ domain. The provided references identify stable kernel commits containing the resolution.

Published Jun 25, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

gpio: rockchip: fix generic IRQ chip leak on remove

The driver allocates domain generic chips using irqallocdomaingenericchips() during probe. However, on driver remove/teardown, the generic chips are not automatically freed when the IRQ domain is removed because the domain flags do not include IRQDOMAINFLAGDESTROYGC.

This causes both the domain generic chips structure and the associated generic chips to be leaked. Additionally, the generic chips remain on the global gclist and may later be visited by generic IRQ chip suspend, resume, or shutdown callbacks after the GPIO bank has been removed, potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by explicitly calling irqdomainremovegenericchips() before removing the IRQ domain in rockchipgpioremove().

Affected Software

10 affected components

Linux gpio: rockchip (Linux kernel)

Linux Linux kernel>=5.15<6.18.36

Linux Linux kernel>=6.19<7.0.13

Linux Linux kernel=7.1-rc1

Linux Linux kernel=7.1-rc2

Linux Linux kernel=7.1-rc3

Linux Linux kernel=7.1-rc4

Linux Linux kernel=7.1-rc5

Linux Linux kernel=7.1-rc6

Linux Linux kernel=7.1-rc7

Event History

Jun 25, 2026

CVE Published

via MITRE·08:39 AM

Data Sourced

via MITRE·08:39 AM

Description

Data Sourced

via NVD·09:16 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What conditions are required to trigger the crash risk?

The Rockchip GPIO driver must first be removed or torn down. A later generic IRQ chip suspend, resume, or shutdown callback can then visit the stale generic chip entry and potentially access freed GPIO-bank memory, causing a kernel crash.

Is this remotely exploitable?

The supplied CVSS vector identifies local attack access with low privileges and no user interaction. The described impact is availability only: a potential kernel crash; no confidentiality or integrity impact is specified.

What is the mitigation if the fix cannot be applied immediately?

Avoid removing or tearing down the affected Rockchip GPIO driver, particularly before system suspend, resume, or shutdown operations. The described fix is to remove the domain's generic IRQ chips before removing the IRQ domain.

How can I determine whether a system contains the fix?

Check whether rockchip_gpio_remove() explicitly calls irq_domain_remove_generic_chips() before it removes the IRQ domain. The provided references identify stable kernel commits containing the resolution.

CVE-2026-53226: gpio: rockchip: fix generic IRQ chip leak on remove

Affected Software

Event History

Frequently Asked Questions

What conditions are required to trigger the crash risk?

Is this remotely exploitable?

What is the mitigation if the fix cannot be applied immediately?

How can I determine whether a system contains the fix?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the crash risk?

Is this remotely exploitable?

What is the mitigation if the fix cannot be applied immediately?

How can I determine whether a system contains the fix?