CVE-2026-98605: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiodgetoptional() to devmgpiodgetoptional() while keeping the matching gpiodput() calls. That combination is wrong for a managed descriptor.

However, dropping the puts and keeping the managed get is also wrong: samsungdsimregisterteirq() runs from the DSI host attach callback, and host detach/reattach can happen without destroying the device that owns the managed action. A second attach would then request the GPIO again without having released it.

Switch back to a non-managed gpiodgetoptional() and keep the explicit gpiodput() on the requestirq() error path and in samsungdsimunregisterteirq().

[Luca: remove unnecessary comment]

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 18, 2026

CVE Published

via MITRE·03:19 PM

Data Sourced

via MITRE·03:19 PM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using the Linux kernel samsung-dsim DRM bridge driver with a TE GPIO configured are affected. The problem is tied to DSI host attach, detach, and reattach handling rather than to all Linux kernel systems generally.

What condition triggers the faulty GPIO lifetime handling?

The condition can occur when the DSI host is detached and later reattached without destroying the device that owns the managed GPIO action. On the second attach, the driver can attempt to request the TE GPIO again even though the prior managed acquisition was not released.

Is a default configuration necessarily affected?

No. The affected path concerns the optional TE GPIO used by the samsung-dsim driver, so systems without that GPIO configured do not use this acquisition path.

What is the relevant remediation?

Use the corrected driver behavior that acquires the TE GPIO with non-managed gpiod_get_optional() and explicitly releases it on IRQ-request failure and during TE IRQ unregistration. This ensures the GPIO is released between host detach and reattach operations.

CVE-2026-98605: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What condition triggers the faulty GPIO lifetime handling?

Is a default configuration necessarily affected?

What is the relevant remediation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What condition triggers the faulty GPIO lifetime handling?

Is a default configuration necessarily affected?

What is the relevant remediation?