CVE-2026-64241: gpio: rockchip: teardown bugs and resource leaks
In the Linux kernel, the following vulnerability has been resolved:
gpio: rockchip: teardown bugs and resource leaks
Address several teardown issues and resource leaks in the driver's remove path and error handling:
1. Debounce clock reference leak: The debounce clock (bank->dbclk) is obtained using ofclkget() which increments the clock's reference count, but clkput() is never called. Register a devm action to cleanly release it on unbind. Note that ofclkget(..., 1) remains necessary over devmclkget() because the DT binding does not define clock-names, precluding name-based lookup.
2. Unregistered chained IRQ handler: The chained IRQ handler is not disconnected in remove(). If a stray interrupt fires after the driver is removed, the kernel attempts to execute a stale handler, leading to a panic. Fix this by clearing the handler in remove().
3. IRQ domain leak: The linear IRQ domain and its generic chips are allocated manually during probe but never removed. Remove the IRQ domain during driver teardown to free the associated generic chips and mappings.
[Bartosz: don't emit an error message on devres allocation failure]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the driver’s remove() path, clear the handler for the debounce clock (bank->db_clk) to fix the debounce clock reference leak and ensure any stray references/handlers are not left active after unbind.
Linux kernel gpio: rockchip driver Debounce clock handler clearing in remove() = Clear the debounce clock (bank->db_clk) handler during driver teardown in remove() - Configuration
In the driver’s remove() path, remove the IRQ domain (linear IRQ domain) and unregistered chained IRQ handler resources, and ensure the linear IRQ domain is cleaned up to free the associated generic chips and prevent leaked IRQ domain resources.
Linux kernel gpio: rockchip driver IRQ domain teardown = Remove the linear IRQ domain and its generic chips during driver teardown - Configuration
Ensure the chained IRQ handler that was allocated during probe but not removed is cleanly released in the driver’s remove()/unbind teardown path to prevent stray interrupts from executing a stale handler and panicking the kernel.
Linux kernel gpio: rockchip driver Unregistered chained IRQ handler cleanup = Cleanly release the chained IRQ handler on unbind/remove() - Configuration
Register a devm action to cleanly release clocks obtained via of_clk_get(..., 1): since the DT binding does not define clock-names and of_clk_get increments the clock reference, ensure the driver calls clk_put() via the registered devm action during teardown.
Linux kernel gpio: rockchip driver clk reference release (clk_put/of_clk_get path) = Use devm action for of_clk_get and ensure clk_put is called
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64241?
The severity of CVE-2026-64241 is rated as 50.
What vulnerabilities are addressed in CVE-2026-64241?
CVE-2026-64241 addresses teardown bugs and resource leaks in the GPIO driver for Rockchip in the Linux kernel.
How can I mitigate the issues caused by CVE-2026-64241?
To mitigate the issues caused by CVE-2026-64241, you should update your Linux kernel to the latest version where this vulnerability is resolved.
Which software is affected by CVE-2026-64241?
CVE-2026-64241 affects the Linux kernel, specifically the GPIO driver for Rockchip.
When was CVE-2026-64241 published?
CVE-2026-64241 was published on July 24, 2026.