Executive brief
The Linux kernel's MT7621 GPIO driver contains a race condition in its interrupt handling code that could allow concurrent operations to corrupt the interrupt trigger configuration for GPIO pins on the same bank. This could result in GPIO pins not responding correctly to interrupts, affecting any device or service relying on GPIO-based interrupt signaling.
Technical details
The vulnerability is a race condition (CWE-362) in the mt7621 GPIO driver's `mediatek_gpio_irq_type()` function. The function modifies bank-shared fields (`rising`, `falling`, `hlevel`, `llevel`) using non-atomic read-modify-write operations without synchronization. Since each GPIO chip instance represents an entire bank of 32 pins, concurrent calls to `mediatek_gpio_irq_type()` for different IRQs on the same bank can overwrite each other's configuration, causing interrupt trigger state corruption. The fix adds spinlock protection (`guard(spinlock_irqsave)`) around the shared state modifications, matching the locking already used in related `mediatek_gpio_irq_mask()` and `mediatek_gpio_irq_unmask()` callbacks. The vulnerability requires only local access and the ability to trigger concurrent IRQ configuration changes on the same GPIO bank.
Affected products
- Linux Linux kernel Multiple versions up to and including recent stable branches
Timeline
- 2026-08-15: disclosed
- 2026-06-30: patched
- 2026-06-26: other: Fix committed upstream