CVE-2026-53226CWE-401

CVE-2026-53226

Medium · published June 25, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
1.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

gpio: rockchip: fix generic IRQ chip leak on remove

The driver allocates domain generic chips using

irq_alloc_domain_generic_chips() during probe. However, on driver

remove/teardown, the generic chips are not automatically freed when the

IRQ domain is removed because the domain flags do not include

IRQ_DOMAIN_FLAG_DESTROY_GC.

This causes both the domain generic chips structure and the associated

generic chips to be leaked. Additionally, the generic chips remain on

the global gc_list and may later be visited by generic IRQ chip suspend,

resume, or shutdown callbacks after the GPIO bank has been removed,

potentially resulting in a use-after-free and kernel crash.

Fix the resource leak by explicitly calling

irq_domain_remove_generic_chips() before removing the IRQ domain in

rockchip_gpio_remove().

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00119 · 1.7th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-06-25T13:16Z
Affected products (9)
ProductVersionsFixed in
linux/linux_kernel≥ 5.15, < 6.18.366.18.36
linux/linux_kernel≥ 6.19, < 7.0.137.0.13
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (5)
EPSS history
Timeline
  • 25 JUN 08:39Z
    gpio: rockchip: fix generic IRQ chip leak on remove
    cvelistv5