Executive brief
A vulnerability in the Linux kernel's handling of certain hardware chips (MCP23S08 pinctrl) can cause the system to crash during startup or after a reboot. This occurs when the hardware sends signals to the operating system before the system is fully ready to process them. An exploit would result in a complete system failure (kernel crash), impacting service availability.
Technical details
A vulnerability exists in the MCP23S08 pinctrl driver within the Linux kernel where interrupts are not properly disabled during the 'probe' phase. If the hardware has 'interrupt-on-change' enabled (e.g., following a reboot), it may generate interrupts for pins before nested handlers are registered. This leads to a NULL pointer dereference or an invalid memory read in the interrupt handler, resulting in a kernel oops/crash. The issue was made manifest by a change in how register defaults are initialized from hardware. Patches have been released to disable all pin interrupts during the initialization of the MCP_GPINTEN register.
Affected products
- Linux Linux Kernel 6.19.1 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-03-30: patched: Initial patch authored
- 2026-05-06: disclosed: CVE published