CVE-2026-53226: gpio: rockchip: fix generic IRQ chip leak on remove
In the Linux kernel, the following vulnerability has been resolved:
gpio: rockchip: fix generic IRQ chip leak on remove
The driver allocates domain generic chips using irqallocdomaingenericchips() during probe. However, on driver remove/teardown, the generic chips are not automatically freed when the IRQ domain is removed because the domain flags do not include IRQDOMAINFLAGDESTROYGC.
This causes both the domain generic chips structure and the associated generic chips to be leaked. Additionally, the generic chips remain on the global gclist and may later be visited by generic IRQ chip suspend, resume, or shutdown callbacks after the GPIO bank has been removed, potentially resulting in a use-after-free and kernel crash.
Fix the resource leak by explicitly calling irqdomainremovegenericchips() before removing the IRQ domain in rockchipgpioremove().
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the crash risk?
The Rockchip GPIO driver must first be removed or torn down. A later generic IRQ chip suspend, resume, or shutdown callback can then visit the stale generic chip entry and potentially access freed GPIO-bank memory, causing a kernel crash.
Is this remotely exploitable?
The supplied CVSS vector identifies local attack access with low privileges and no user interaction. The described impact is availability only: a potential kernel crash; no confidentiality or integrity impact is specified.
What is the mitigation if the fix cannot be applied immediately?
Avoid removing or tearing down the affected Rockchip GPIO driver, particularly before system suspend, resume, or shutdown operations. The described fix is to remove the domain's generic IRQ chips before removing the IRQ domain.
How can I determine whether a system contains the fix?
Check whether rockchip_gpio_remove() explicitly calls irq_domain_remove_generic_chips() before it removes the IRQ domain. The provided references identify stable kernel commits containing the resolution.