CVE-2026-72063: gpio: tegra: do not call pinctrl for GPIO direction
In the Linux kernel, the following vulnerability has been resolved:
gpio: tegra: do not call pinctrl for GPIO direction
tegragpiodirectioninput() and tegragpiodirectionoutput() already program the GPIO controller direction registers directly. The additional pinctrlgpiodirectioninput/output() calls do not add a Tegra pinctrl operation, because the Tegra pinmux ops provide GPIO request/free handling but no gpiosetdirection hook.
The extra call still enters the pinctrl core and takes pctldev->mutex. Shared GPIO users can call the direction path while holding their per-line spinlock, so this otherwise redundant pinctrl direction call can sleep in an atomic context.
This was found by our static analysis tool and then confirmed by manual review of tegragpioprobe(), the Tegra GPIO direction callbacks and the Tegra pinctrl ops. The reviewed path has a default non-sleeping struct gpiochip while the direction callback still enters the pinctrl mutex path.
A directed runtime validation kept the same non-sleeping chip registration and drove:
gpiosharedproxydirectionoutput() gpioddirectionoutputrawcommit() tegragpiodirectionoutput() pinctrlgpiodirectionoutput()
Lockdep reported a sleep-in-atomic warning with the shared GPIO spinlock held and pinctrlgetdevicegpiorange() plus tegragpiodirectionoutput() on the stack.
Do not mark the whole chip as cansleep to paper over this: cansleep describes whether get()/set() may sleep, and Tegra value access is MMIO. Remove the redundant pinctrl direction calls and keep pinctrl involvement in the existing request/free path.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72063?
CVE-2026-72063 has a risk level of 18.
What does CVE-2026-72063 affect?
CVE-2026-72063 affects the GPIO handling in the Linux kernel specifically related to the Tegra platform.
How do I fix CVE-2026-72063?
To fix CVE-2026-72063, update your Linux kernel to the patched version where the vulnerability is resolved.
When was CVE-2026-72063 published?
CVE-2026-72063 was published on August 15, 2026.
What is the main issue described in CVE-2026-72063?
The main issue in CVE-2026-72063 is unnecessary pinctrl calls for GPIO direction management in the Tegra GPIO driver.