CVE-2026-93274: pinctrl: bcm2835: Don't remove an unregistered GPIO chip
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: bcm2835: Don't remove an unregistered GPIO chip
If the devmpinctrlregister() function fails, bcm2835pinctrlprobe() calls gpiochipremove() before gpiochipadddata() has registered the GPIO chip.
This means that upon failure the gpiochip.gpiodev is NULL resulting in a null pointer dereference inside the gpiochipremove() function.
Remove the unnecessary function call to gpiochipremove(). No GPIO cleanup is required because the GPIO chip has not yet been registered. Without this change there is potential for a kernel panic upon registration failure
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Remove the gpiochip_remove() call from bcm2835_pinctrl_probe() on the devm_pinctrl_register() failure path, because gpiochip_add_data() has not yet registered the GPIO chip.
Event History
Frequently Asked Questions
When can this issue cause a kernel panic?
A kernel panic is possible if bcm2835_pinctrl_probe() reaches a devm_pinctrl_register() failure. The failure path then attempts to remove a GPIO chip that was never registered, causing a null pointer dereference.
Is GPIO cleanup needed if the pin controller registration fails?
No. The GPIO chip has not been registered at that point, so no GPIO cleanup is required; removing the unnecessary gpiochip_remove() call avoids the null pointer dereference.