Junglewise Threat Intelligence

CVE-2026-80999: Linux kernel Realtek DSA GPIO API misuse

CVE-2026-80999 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's Realtek DSA network driver incorrectly used a synchronous GPIO function when communicating with reset pins connected through I2C-based GPIO controllers. This causes kernel warnings and potential hangs when a sleeping GPIO controller is used, affecting systems with such configurations.

Technical details

The rtl83xx_reset_assert() and rtl83xx_reset_deassert() functions in the Realtek DSA driver used gpiod_set_value() to control reset GPIOs. This non-sleeping variant is unsafe when the GPIO controller can sleep (e.g., I2C I/O expanders), triggering kernel warnings and potential scheduler deadlocks. The probe path these functions execute in is not timing-critical and can safely sleep. The fix switches both functions to gpiod_set_value_cansleep(), which is safe for sleeping GPIO controllers. The vulnerability was introduced when the code was refactored into separate helpers in v6.9; older kernels have the same issue at inline call sites.

Affected products

  • Linux Linux kernel v6.9+

Timeline

  • 2026-09-11: disclosed

Related threats