Executive brief
A vulnerability in the Linux kernel's GPIO (General Purpose Input/Output) subsystem could cause a system deadlock. This occurs when a specific type of shared hardware component is removed from the system, potentially leading to a complete system hang or denial of service. This affects the stability of the operating system but typically requires local access or specific hardware events to trigger.
Technical details
A deadlock vulnerability exists in the Linux kernel's GPIO subsystem within `drivers/gpio/gpiolib-shared.c`. The issue was introduced by an overly broad critical section using a mutex in `struct gpio_shared_entry` intended to protect the `offset` field. When the parent of a shared GPIO proxy is removed, the wide locking scope can lead to a circular dependency and subsequent deadlock. The fix involves shortening the critical section to only protect the `offset` field during read operations. This is a local denial-of-service vulnerability reachable during device teardown.
Affected products
- Linux Linux Kernel 6.19.12, 7.0, 7.0.12
Timeline
- 2026-05-22: disclosed: Initial patch submitted
- 2026-07-24: advisory: CVE published and NVD record created