Skip to main content

Linux Kernel CVE-2026-53226

| EUVDEUVD-2026-39317 MEDIUM
Memory Leak (CWE-401)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-fw97-88cp-67m9
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only vector (AV:L) requiring low-privilege account (PR:L); availability-only impact from kernel crash; no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 02, 2026 - 23:00 vuln.today
CVSS changed
Jul 02, 2026 - 20:52 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

gpio: rockchip: fix generic IRQ chip leak on remove

The driver allocates domain generic chips using irq_alloc_domain_generic_chips() during probe. However, on driver remove/teardown, the generic chips are not automatically freed when the IRQ domain is removed because the domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated generic chips to be leaked. Additionally, the generic chips remain on the global gc_list and may later be visited by generic IRQ chip suspend, resume, or shutdown callbacks after the GPIO bank has been removed, potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by explicitly calling irq_domain_remove_generic_chips() before removing the IRQ domain in rockchip_gpio_remove().

AnalysisAI

Resource leak and use-after-free in the Linux kernel's gpio-rockchip driver can crash the kernel on systems using Rockchip GPIO hardware. The driver's remove path fails to call irq_domain_remove_generic_chips(), leaving allocated generic chip structures unreleased and dangling on the global gc_list. After driver unbind or module removal, IRQ subsystem suspend, resume, or shutdown callbacks may subsequently dereference the freed memory, producing a use-after-free condition and kernel panic. No public exploit exists and EPSS sits at the 7th percentile, indicating very low real-world exploitation probability; however, the availability of upstream fix commits makes patching straightforward.

Technical ContextAI

The affected code resides in drivers/gpio/gpio-rockchip.c within the Linux kernel's GPIO subsystem. During probe, irq_alloc_domain_generic_chips() allocates an IRQ domain and associated generic chip structures; these are registered globally on gc_list for use by IRQ framework callbacks (irq_gc_suspend, irq_gc_resume, irq_gc_shutdown). The domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC, so irq_domain_remove() does not automatically free the generic chips. CWE-401 (Missing Release of Memory after Effective Lifetime) precisely describes the root cause: memory allocated during probe is never reclaimed during remove. The fix adds an explicit irq_domain_remove_generic_chips() call before irq_domain_remove() in rockchip_gpio_remove(). Affected CPEs span linux_kernel across a wide version range per NVD (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*) and include Linux kernel 7.1 RC1 through RC7 by name.

RemediationAI

Upgrade to a kernel version containing one of the three fix commits: bace7b99bfa555fe833aee8827b8004c43666d02 (stable branch), 1c1e0fc88d6ef65bf15d517853251f75ab9d18c3, or 1f34ea5f6114011092d9a5c8b901ad6741144a1d, all available at https://git.kernel.org/stable/. Distribution-specific fixes are available in Linux 6.18.36, Linux 7.0.13, or Linux 7.1 stable. For embedded Rockchip systems that cannot be updated immediately, the compensating control is to avoid unloading or hot-removing the gpio-rockchip kernel module (modprobe -r gpio-rockchip or driver unbind via sysfs) while the system remains running; disabling module auto-removal prevents the remove path from being triggered. This workaround prevents the kernel crash but does not address the underlying memory leak if the driver is ever removed. No other workarounds are meaningful since the flaw is in driver teardown code, not runtime operation.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53226 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy