Skip to main content

Linux Kernel EUVDEUVD-2026-48650

| CVE-2026-64241 MEDIUM
Memory Leak (CWE-401)
2026-07-24 Linux GHSA-vwqh-89qp-xcpw
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.1 MEDIUM

Kernel module removal requires root (PR:H); panic requires a post-unbind hardware interrupt race, raising AC:H; no confidentiality or integrity impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 13, 2026 - 19:31 vuln.today
CVSS changed
Aug 13, 2026 - 17:22 NVD
5.5 (MEDIUM)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:27 nvd
MEDIUM 5.5
CVE Published
Jul 24, 2026 - 15:27 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

gpio: rockchip: teardown bugs and resource leaks

Address several teardown issues and resource leaks in the driver's remove path and error handling:

  1. Debounce clock reference leak: The debounce clock (bank->db_clk) is

obtained using of_clk_get() which increments the clock's reference count, but clk_put() is never called. Register a devm action to cleanly release it on unbind. Note that of_clk_get(..., 1) remains necessary over devm_clk_get() because the DT binding does not define clock-names, precluding name-based lookup.

  1. Unregistered chained IRQ handler: The chained IRQ handler is not

disconnected in remove(). If a stray interrupt fires after the driver is removed, the kernel attempts to execute a stale handler, leading to a panic. Fix this by clearing the handler in remove().

  1. IRQ domain leak: The linear IRQ domain and its generic chips are

allocated manually during probe but never removed. Remove the IRQ domain during driver teardown to free the associated generic chips and mappings.

[Bartosz: don't emit an error message on devres allocation failure]

AnalysisAI

Resource leaks and teardown race conditions in the Linux kernel's gpio-rockchip driver expose Rockchip-based systems to kernel panic and memory exhaustion. Three distinct defects exist in the driver's remove path: an unreleased debounce clock reference, a stale chained IRQ handler left registered after driver removal, and an unfreed IRQ domain with its generic chips. The IRQ handler defect is the most severe - if a stray GPIO interrupt arrives after the driver is unbound, the kernel dereferences a stale function pointer and panics. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects the niche, hardware-specific exploitation surface.

Technical ContextAI

The affected driver, gpio-rockchip, manages GPIO banks on Rockchip ARM SoCs (RK3xxx family) under the Linux kernel GPIO subsystem. CPE confirms the Linux kernel itself as the vulnerable component (cpe:2.3:a:linux:linux). The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime), manifesting across three resource types: (1) a clock handle obtained via of_clk_get() whose reference count is never decremented with clk_put() - of_clk_get() is used instead of the devm_ variant because the DT binding lacks clock-names for name-based lookup; (2) a chained IRQ handler registered in probe() but not unregistered in remove(), leaving a stale handler pointer in the IRQ subsystem; (3) a linear IRQ domain and associated generic chips allocated manually during probe but never freed. The stale IRQ handler is the most dangerous: post-unbind interrupt delivery causes the kernel to execute an invalid code path, resulting in a panic. Repeated bind/unbind cycles (e.g., during hotplug or module reload) would accumulate leaked clock references and IRQ domains.

RemediationAI

Vendor-released patch: upgrade to Linux 6.12.96, 6.18.35, 7.0.12, or 7.1 as appropriate for the running stable branch. Commit-level fixes are backported across four stable trees at the git.kernel.org links listed in affected products. Ubuntu users should apply packages addressed in USN-8618-1. If patching is immediately unavailable, the most impactful compensating control is to avoid unloading or rebinding the gpio-rockchip module on production systems - this eliminates the stale-handler panic window and prevents clock/IRQ domain leak accumulation. Trade-off: this precludes runtime driver updates without a full reboot. On non-critical embedded systems, disabling GPIO interrupt-driven features (if application-level configuration allows) reduces exposure to the stale-handler race but does not eliminate the resource leak. No network-facing mitigations are applicable given the local-only attack surface.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Micro 6.2 Fixed
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server for SAP applications 16.0 Affected
SUSE Linux Micro Extras 6.2 Affected

Share

EUVD-2026-48650 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy