CVE-2026-53226

Analyzed Analyzed - Analysis Complete

IRQ Chip Leak in Rockchip GPIO Driver

Publication date: 2026-06-25

Last updated on: 2026-07-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: fix generic IRQ chip leak on remove The driver allocates domain generic chips using irq_alloc_domain_generic_chips() during probe. However, on driver remove/teardown, the generic chips are not automatically freed when the IRQ domain is removed because the domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC. This causes both the domain generic chips structure and the associated generic chips to be leaked. Additionally, the generic chips remain on the global gc_list and may later be visited by generic IRQ chip suspend, resume, or shutdown callbacks after the GPIO bank has been removed, potentially resulting in a use-after-free and kernel crash. Fix the resource leak by explicitly calling irq_domain_remove_generic_chips() before removing the IRQ domain in rockchip_gpio_remove().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-02

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53226

EUVD

EUVD-2026-39317

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.15 (inc) to 6.18.36 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's rockchip GPIO driver. During the driver's probe phase, it allocates generic IRQ chips using irq_alloc_domain_generic_chips(). However, when the driver is removed or torn down, these generic chips are not automatically freed because the IRQ domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC.

As a result, the generic chips and their associated structures are leaked. These leaked chips remain on a global list (gc_list) and may be accessed later by suspend, resume, or shutdown callbacks even after the GPIO bank has been removed. This can lead to use-after-free conditions and potentially cause the kernel to crash.

The fix involves explicitly calling irq_domain_remove_generic_chips() before removing the IRQ domain in the rockchip_gpio_remove() function to properly free these resources.

Compliance Impact

The provided information does not include any details about the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Impact Analysis

This vulnerability can lead to resource leaks and use-after-free conditions in the Linux kernel, specifically within the rockchip GPIO driver.

The use-after-free may cause kernel crashes, which can result in system instability, unexpected reboots, or denial of service.

Such instability can affect the reliability and availability of systems running vulnerable versions of the Linux kernel, potentially impacting any applications or services dependent on them.

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the gpio: rockchip driver leak issue.

The fix involves explicitly calling irq_domain_remove_generic_chips() before removing the IRQ domain in rockchip_gpio_remove(), which prevents the resource leak and potential kernel crash.

Hi! I’m here to help you understand CVE-2026-53226. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70