CVE-2026-43087
Kernel Crash Due to Unhandled Pin Interrupts in MCP23S08
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's pinctrl driver for the MCP23S08 chip. When the chip is probed during initialization, it may have the interrupt-on-change feature enabled on some pins from a previous state, such as after a reboot. This causes the chip to generate interrupts for pins that do not have a registered nested interrupt handler, leading to a kernel crash due to an attempt to handle an interrupt that the kernel is not prepared for.
The issue became apparent after a specific commit changed how the MCP_GPINTEN register value is read, causing the kernel to read the actual hardware value instead of assuming a default zero. If this register has a non-zero value, it can trigger nested interrupt handlers that may not exist yet, resulting in a crash. The fix involves disabling all pin interrupts during the chip's initialization to prevent these unexpected interrupts.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash unexpectedly during the initialization of the MCP23S08 chip driver. Such a kernel crash (kernel panic) can lead to system instability, downtime, and potential loss of data or service availability. Systems relying on this driver for hardware interaction may experience interruptions or failures, impacting reliability and uptime.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a kernel crash related to the mcp23s08 pinctrl driver when interrupts are generated for pins without a registered nested handler.
To detect this issue on your system, you can check the kernel logs for error messages similar to the following indicative crash trace:
- Look for kernel messages containing "Unable to handle kernel read from unreadable memory at virtual address 00000000000000ac" or "Internal error: Oops" related to irq/18-4-0025 or mcp23s08_irq.
- Use the command: dmesg | grep -i 'mcp23s08' to filter kernel messages related to the vulnerable driver.
- Check for recent kernel oops or panic logs with: journalctl -k | grep -i 'Oops' or journalctl -k | grep -i 'mcp23s08'.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by disabling all pin interrupts during the probe (initialization) of the mcp23s08 chip in the Linux kernel.
Immediate mitigation steps include:
- Update your Linux kernel to a version that includes the fix from commit "f9f4fda15e72" or later, which disables pin interrupts during initialization.
- If updating the kernel is not immediately possible, consider rebooting the system to clear any enabled interrupt-on-change features on the chip pins.
- Monitor kernel logs for crashes and avoid using the affected hardware or driver until patched.