Executive brief
A vulnerability in the Linux kernel's Marvell Armada (mvebu) GPIO driver can cause a system crash when the device attempts to enter or wake up from sleep mode. This occurs because the system tries to access power management features on hardware components that do not support them. An exploit would result in a complete system failure (kernel panic), impacting service availability.
Technical details
A NULL pointer dereference exists in the mvebu GPIO driver (drivers/gpio/gpio-mvebu.c) within the mvebu_pwm_suspend() and mvebu_pwm_resume() functions. While these functions are invoked for all GPIO banks during power state transitions, not all banks possess Pulse Width Modulation (PWM) functionality; for those without it, the mvchip->mvpwm pointer is NULL. Attempting to access mvpwm->blink_select without a NULL check triggers an Oops. This can be triggered by a local user with sufficient privileges to initiate a system suspend/resume. The issue has been resolved by adding explicit NULL checks for the mvpwm pointer in the affected power management callbacks.
Affected products
- Linux Linux Kernel 757642f9a584 to 7db09011ce62162d72897fc4856b4425245dfe35
Timeline
- 2026-06-08: other: Patch submitted by Yun Zhou
- 2026-06-19: patched: Commits merged into stable branches
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/4ef24338eda3c7e96d6f94a988266ff16ed3985d
- https://git.kernel.org/stable/c/6136c1474db88272231573e222896e1998d34662
- https://git.kernel.org/stable/c/7db09011ce62162d72897fc4856b4425245dfe35
- https://git.kernel.org/stable/c/b9ad50d7505ebd48282ec3630258dc820fc85c81
- https://git.kernel.org/stable/c/c9677a9274ffb44987ec209dc8ec9f2d34946956