Executive brief
The MediaTek pinctrl driver manages hardware interrupt line configuration (EINT) on mobile SoCs. When the driver module is unloaded, it previously failed to clean up interrupt resources, leaving dangling interrupt handlers and freed memory references. This causes kernel panics or memory corruption when the orphaned interrupt handler fires after the driver is unloaded.
Technical details
The vulnerability is a resource leak in the MediaTek pinctrl driver's mtk_eint_do_init() function. When the driver is built as a module and unloaded, the function creates an IRQ domain and chained interrupt handler but never releases them on unbind. This leaves dangling interrupt mappings with pointers to freed memory and an active chained handler that continues to fire into that freed data. The fix registers a device-managed cleanup action (devm_add_action_or_reset) that properly detaches the chained handler, synchronizes in-flight interrupts, disposes per-line mappings, and removes the IRQ domain. No remote or privilege escalation pathway is described; the impact is limited to local denial of service on module unload.
Affected products
- Linux Linux kernel All versions with modular MediaTek pinctrl driver (linux-5.x and later)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched