CVE-2026-53226: Linux Rockchip GPIO Driver IRQ Leak and Use-After-Free

Technical summary

CVE-2026-53226 is a resource leak and potential use-after-free vulnerability in the Rockchip GPIO driver (gpio/rockchip) in the Linux kernel. During driver probe, the code allocates domain generic chips via irq_alloc_domain_generic_chips(). However, the IRQ domain is created without the IRQ_DOMAIN_FLAG_DESTROY_GC flag, which means the generic chip structures are not automatically freed when the domain is torn down. This causes two problems: (1) a persistent memory leak of the domain generic chips structure and associated chip objects, and (2) orphaned generic chips remain on the global gc_list and remain callable by generic IRQ suspend, resume, and shutdown callbacks even after the GPIO bank hardware has been removed. This can trigger a use-after-free condition and kernel panic. The remediation is to call irq_domain_remove_generic_chips() explicitly in rockchip_gpio_remove() before removing the IRQ domain.

Business impact

Systems running affected Linux kernel versions with Rockchip GPIO hardware will experience kernel memory leaks over time as the GPIO driver is loaded and unloaded (common during driver updates, hot-plug events, or system troubleshooting). Sustained memory pressure can degrade system performance. More critically, the use-after-free risk means an unexpected kernel crash is possible during system suspend/resume cycles or GPIO driver reloads, potentially causing service interruptions or data loss in systems relying on continuous operation.

Affected systems

The vulnerability affects the Linux kernel across multiple versions. Rockchip-based systems—including various ARM SoCs used in mobile devices, single-board computers, and embedded systems—are in scope. Any system that loads and unloads the Rockchip GPIO driver is vulnerable to the memory leak; systems that perform suspend/resume cycles or dynamic driver management face elevated risk of the use-after-free crash.

Exploitability

This is not a vulnerability that can be exploited remotely or by unprivileged users to gain unauthorized access. It requires local system access and the ability to trigger driver removal (e.g., via module unload, device hot-removal, or system suspend). The crash and memory exhaustion impact is local to the affected system. No public exploit code is known, and the vulnerability is a resource management bug rather than a logic flaw that enables privilege escalation or data theft.

Remediation

Apply a kernel update that includes the fix for the Rockchip GPIO driver. The remediation adds an explicit call to irq_domain_remove_generic_chips() in the rockchip_gpio_remove() function to ensure proper cleanup of allocated interrupt domain structures before domain removal. Verify the specific patch version against your Linux distribution's advisory, as backports and release timing vary.

Patch guidance

Identify your Linux kernel version and Rockchip platform. Check with your distribution (Red Hat, Canonical, etc.) or the Linux kernel security advisory for the patched kernel version that includes the fix to gpio/rockchip. Kernel updates should be applied during a maintenance window that allows for system restart. After patching, monitor system logs for any error messages related to GPIO or IRQ domain operations.

Detection guidance

Proactively monitor kernel memory usage and leaked memory statistics for Rockchip GPIO systems, particularly after driver reload or suspend/resume cycles. Enable kernel memory debugging (CONFIG_DEBUG_KMEMLEAK) in test environments to detect resource leaks. Watch system logs (dmesg) for warnings or panics tied to generic IRQ chip operations. If available, use perf or systemtap to instrument driver removal paths and confirm cleanup functions are called. Detection of active exploitation is difficult without intrusive instrumentation; focus on timely patching.

Why prioritize this

CVSS 5.5 (MEDIUM) reflects local access requirement and absence of remote exploitability, but the use-after-free and kernel panic risk makes this important for systems that rely on continuous uptime. Rockchip GPIO hardware is common in embedded and mobile platforms; prioritize Rockchip-based servers and critical embedded systems for prompt patching. The memory leak aspect is a lower-priority concern unless the system is memory-constrained.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM, vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects: local attack vector (no remote exploitation), low complexity to trigger (unload or suspend), low privilege required (user-level driver unload in some configurations), no user interaction, and high availability impact (crash). The vulnerability does not compromise confidentiality or integrity, only availability and system stability.

Frequently asked questions