CVE-2026-53226
Received Received - Intake
IRQ Chip Leak in Rockchip GPIO Driver

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: fix generic IRQ chip leak on remove The driver allocates domain generic chips using irq_alloc_domain_generic_chips() during probe. However, on driver remove/teardown, the generic chips are not automatically freed when the IRQ domain is removed because the domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC. This causes both the domain generic chips structure and the associated generic chips to be leaked. Additionally, the generic chips remain on the global gc_list and may later be visited by generic IRQ chip suspend, resume, or shutdown callbacks after the GPIO bank has been removed, potentially resulting in a use-after-free and kernel crash. Fix the resource leak by explicitly calling irq_domain_remove_generic_chips() before removing the IRQ domain in rockchip_gpio_remove().
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53226
EUVD
EUVD-2026-39317
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
rockchip gpio *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's rockchip GPIO driver. During the driver's probe phase, it allocates generic IRQ chips using irq_alloc_domain_generic_chips(). However, when the driver is removed or torn down, these generic chips are not automatically freed because the IRQ domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC.

As a result, the generic chips and their associated structures are leaked. These leaked chips remain on a global list (gc_list) and may be accessed later by suspend, resume, or shutdown callbacks even after the GPIO bank has been removed. This can lead to use-after-free conditions and potentially cause the kernel to crash.

The fix involves explicitly calling irq_domain_remove_generic_chips() before removing the IRQ domain in the rockchip_gpio_remove() function to properly free these resources.

Impact Analysis

This vulnerability can lead to resource leaks and use-after-free conditions in the Linux kernel, specifically within the rockchip GPIO driver.

The use-after-free may cause kernel crashes, which can result in system instability, unexpected reboots, or denial of service.

Such instability can affect the reliability and availability of systems running vulnerable versions of the Linux kernel, potentially impacting any applications or services dependent on them.

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the gpio: rockchip driver leak issue.

The fix involves explicitly calling irq_domain_remove_generic_chips() before removing the IRQ domain in rockchip_gpio_remove(), which prevents the resource leak and potential kernel crash.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53226. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart