CVE-2026-72324
Received Received - Intake

Memory Leak in Linux Kernel GPIO Subsystem

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: gpio: mvebu: free generic chips on unbind irq_alloc_domain_generic_chips() allocates generic chip data that must be freed via irq_domain_remove_generic_chips(). The devres action mvebu_gpio_remove_irq_domain() only called irq_domain_remove(), which only frees the generic chips if IRQ_DOMAIN_FLAG_DESTROY_GC is set. Call irq_domain_remove_generic_chips() explicitly before irq_domain_remove() instead.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72324
EUVD
EUVD-2026-59223

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where generic GPIO chip data allocated by irq_alloc_domain_generic_chips() is not properly freed during unbind operations. The cleanup function mvebu_gpio_remove_irq_domain() only calls irq_domain_remove(), which fails to free the generic chips unless a specific flag IRQ_DOMAIN_FLAG_DESTROY_GC is set. The fix involves explicitly calling irq_domain_remove_generic_chips() before irq_domain_remove().

Detection Guidance

This vulnerability is specific to the Linux kernel's GPIO subsystem (mvebu driver). Detection requires checking kernel logs for unbind issues in gpio-mvebu or inspecting the driver's behavior during module unloading. Commands like dmesg | grep mvebu or lsmod | grep gpio may help identify related issues.

Impact Analysis

This vulnerability could lead to memory leaks when GPIO drivers are unloaded or devices are unbound. Over time, this may cause system instability, reduced performance, or crashes due to exhausted memory resources.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If using a custom kernel, apply the fix that replaces irq_domain_remove() with irq_domain_remove_generic_chips() in the mvebu GPIO driver.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72324. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart