Junglewise Threat Intelligence

CVE-2026-72324: Linux kernel GPIO MVEBU memory leak on unbind

CVE-2026-72324 · Severity: info · Published 2026-08-15

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's GPIO MVEBU driver fails to properly release memory allocated for interrupt domain generic chip data when the device is unbound. This memory leak could cause kernel memory exhaustion over time on systems using Marvell GPIO hardware, leading to system instability or denial of service.

Technical details

A resource management bug exists in the GPIO MVEBU driver (drivers/gpio/gpio-mvebu.c) where the mvebu_gpio_remove_irq_domain() function calls irq_domain_remove() without first explicitly calling irq_domain_remove_generic_chips(). The irq_alloc_domain_generic_chips() function allocates memory for generic chip data that must be freed via irq_domain_remove_generic_chips(), which only happens automatically if IRQ_DOMAIN_FLAG_DESTROY_GC is set. The fix adds an explicit call to irq_domain_remove_generic_chips() before irq_domain_remove(). This is a local-only memory leak affecting GPIO interrupt domain teardown with no network attack surface.

Affected products

  • Linux Linux kernel Affected by commit 812d47889a8e onwards; patched in upstream and stable trees

Timeline

  • 2026-08-15: disclosed
  • 2026-07-07: patched: Upstream patch authored by Rosen Penev

References

Related threats