Executive brief
A vulnerability was identified in the Linux kernel's pinctrl driver for MCP23S08 chips, which are used to manage input/output pins on various hardware devices. Due to a technical error during the device startup process, the system could attempt to access memory that hasn't been set up yet, leading to a system crash (NULL pointer dereference). This issue primarily affects system stability during the hardware detection phase.
Technical details
A NULL pointer dereference exists in the `pinctrl-mcp23s08_spi.c` driver of the Linux kernel. The vulnerability occurs during the `mcp23s08_probe` phase because `mcp->dev` and `mcp->addr` are not initialized before the `mcp23s08_spi_regmap_init()` function is called. This function triggers `regcache_maple_populate()`, which attempts an SPI read operation that requires these uninitialized pointers. An attacker with the ability to trigger device probing could cause a kernel panic. The issue has been resolved by reordering the initialization sequence in the affected driver.
Affected products
- Linux Linux 6.19, 7.0.13, 7.1
Timeline
- 2026-05-13: disclosed: Initial patch authored by Judith Mendez
- 2026-06-19: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-07-01: advisory: NVD publication date