Executive brief
The Mediatek pinctrl driver manages GPIO pins on Mediatek processors. A memory lifecycle mismatch causes the GPIO chip structure to be freed while still in use when the driver is unloaded as a module, potentially triggering system crashes or undefined behavior. The issue is resolved by aligning the allocation and registration lifecycles.
Technical details
The vulnerability is a use-after-free in the Mediatek pinctrl driver's GPIO chip registration. The gpio_chip structure is allocated with device-managed memory (devm_) but registered via the non-managed gpiochip_add_data() function. When the driver is built as a built-in module and unbound or when it is loaded as a removable module and unloaded, the devm cleanup frees the gpio_chip memory while the GPIO subsystem still holds a reference to it. The fix changes gpiochip_add_data() to devm_gpiochip_add_data(), ensuring the GPIO chip lifecycle is managed by the same device-managed system, eliminating the window where freed memory is still referenced.
Affected products
- Linux Linux kernel Linux 4.14+
Timeline
- 2026-07-25: disclosed
- 2026-09-14: patched