CVE-2026-80648: pinctrl: spacemit: fix NULL check in spacemit_pin_set_config
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: spacemit: fix NULL check in spacemitpinsetconfig
spacemitpinsetconfig() looks up the per-pin descriptor with spacemitgetpin() then checks the wrong variable for failure:
const struct spacemitpin spin = spacemitgetpin(pctrl, pin); ... if (!pin) return -EINVAL;
reg = spacemitpintoreg(pctrl, spin->pin);
pin is an unsigned int pin id, where 0 (GPIO0 / gmac0rxdv on K3) is a valid pin, so rejecting it here drops the PAD config write for the first pin of every group. On K3 Pico-ITX the GMAC RGMII group lists pin 0 as its first entry, so its drive-strength / bias configuration was silently ignored.
The intended guard is against spacemitgetpin() returning NULL when the pin id isn't in the SoC's pin table. Check spin instead, which both restores PAD setup for pin 0 and prevents a NULL deref on spin->pin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix spacemit_pin_set_config to properly check the result of spacemit_get_pin() (spin) before using spin->pin, restoring PAD setup for pin 0 (e.g., GPIO_0 / gmac0_rxdv on K3) and preventing a NULL dereference.
pinctrl: spacemit spacemit_pin_set_config NULL check = Correct NULL check to ensure spacemit_get_pin() failure is handled before dereferencing spin->pin
Event History
Frequently Asked Questions
Which deployments are most clearly affected?
Systems using the SpacemiT pinctrl driver are affected. The K3 Pico-ITX GMAC RGMII pin group is specifically called out because its first entry is pin 0.
What happens when pin 0 is configured?
PAD configuration writes for pin 0 are dropped because the driver treats the zero-valued pin ID as a failure. On the identified GMAC RGMII group, drive-strength and bias settings can therefore be silently ignored.
Is there a crash condition as well as a configuration failure?
Yes. If a requested pin ID is absent from the SoC pin table, the descriptor lookup can return NULL and the driver can dereference it when accessing spin->pin.