CVE-2026-23308: Linux Kernel pinctrl IRQ Vulnerability

CVE-2026-23308 Overview

A vulnerability has been resolved in the Linux kernel's pinctrl equilibrium driver that caused warning traces during module load. The issue occurs in the callback functions eqbr_irq_mask() and eqbr_irq_ack() which are called within eqbr_irq_mask_ack(). The function eqbr_irq_mask() improperly calls gpiochip_disable_irq(), generating warning traces in the kernel log for every GPIO pin during the load process.

Critical Impact

This vulnerability causes kernel warning traces during GPIO initialization, potentially impacting system stability and reliability on affected Linux kernel systems using the equilibrium pinctrl driver.

Affected Products

• Linux kernel (versions using pinctrl equilibrium driver)
• Systems with GPIO chips using the eqbr_irq driver
• Embedded systems utilizing the equilibrium pin controller

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-23308 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23308

Vulnerability Analysis

The vulnerability exists in the Linux kernel's pinctrl equilibrium driver, specifically in how interrupt masking and acknowledgment functions are structured. The design flaw involves code reuse where eqbr_irq_mask_ack() calls both eqbr_irq_mask() and eqbr_irq_ack() to avoid code duplication. However, eqbr_irq_mask() includes a call to gpiochip_disable_irq() from the gpiolib subsystem, which triggers a warning condition when called in this context.

The warning originates from drivers/gpio/gpiolib.c:3810 in the gpiochip_disable_irq() function. When the driver loads, this warning is generated for every GPIO pin, resulting in a flood of kernel warnings. The stack trace shows the call path: eqbr_irq_mask_ack() → eqbr_irq_mask() → gpiochip_disable_irq(), where the final call triggers the warning condition.

Root Cause

The root cause is improper function composition in the interrupt handling callbacks. The eqbr_irq_mask() function was designed to handle standalone masking operations, including disabling the IRQ through gpiolib. When this function is reused within eqbr_irq_mask_ack(), the gpiochip_disable_irq() call becomes inappropriate for that context, as the interrupt state management differs between standalone mask operations and combined mask-acknowledge operations.

The fix implements the masking and acknowledgment logic directly within eqbr_irq_mask_ack() without calling gpiochip_disable_irq(), following a similar pattern used in other pinctrl drivers such as drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c.

Attack Vector

This vulnerability has a local attack vector and is primarily a stability and reliability issue rather than a security exploitation concern. The warning traces occur during normal driver initialization and do not require malicious input. However, the repeated kernel warnings could potentially:

• Fill kernel log buffers with warning messages
• Impact system boot time and performance during GPIO initialization
• Create noise in system monitoring that could mask other critical warnings

The kernel warning trace indicates the issue occurs on CPU 3 during PID 1 (init/swapper) execution, tainting the kernel with a WARN flag during early system initialization.

Detection Methods for CVE-2026-23308

Indicators of Compromise

• Kernel log messages containing WARNING: CPU: * PID: 1 at drivers/gpio/gpiolib.c:3810 gpiochip_disable_irq
• Multiple repeated warning traces during system boot referencing eqbr_irq_mask and eqbr_irq_mask_ack
• Kernel taint flag [W]=WARN present in system logs
• Call traces showing eqbr_irq_mask_ack+0x*/0x* in the stack

Detection Strategies

• Monitor kernel logs during boot for warning traces from the gpiolib subsystem
• Check for kernel taint flags using cat /proc/sys/kernel/tainted and verify WARN-related tainting
• Review dmesg output for patterns matching gpiochip_disable_irq warnings during GPIO initialization
• Implement automated log analysis to detect equilibrium pinctrl driver warning patterns

Monitoring Recommendations

• Configure syslog monitoring for kernel warning patterns related to GPIO and pinctrl subsystems
• Set up alerts for kernel taint events during system initialization
• Monitor system boot times for degradation that may indicate excessive warning generation
• Review driver loading sequences on systems using the equilibrium pin controller

How to Mitigate CVE-2026-23308

Immediate Actions Required

• Update to a patched Linux kernel version that includes the fix
• Review system logs to identify if your systems are affected by this vulnerability
• Prioritize kernel updates for systems using the equilibrium pinctrl driver
• Monitor for availability of backported fixes for your specific kernel distribution

Patch Information

The Linux kernel development team has released patches that resolve this issue by reimplementing the eqbr_irq_mask_ack() function to directly perform masking and acknowledgment operations without calling gpiochip_disable_irq(). Multiple commits address this vulnerability across different kernel branches:

• Linux Kernel Commit Update
• Linux Kernel Commit Fix
• Linux Kernel Commit Change
• Linux Kernel Commit Modification
• Linux Kernel Commit Patch

Workarounds

• If immediate patching is not possible, the warning traces do not prevent system operation but may impact log monitoring
• Consider filtering kernel log output for these specific warning patterns to reduce log noise
• Monitor distribution-specific kernel updates for backported fixes
• For production systems, schedule maintenance windows to apply kernel updates addressing this vulnerability

# Check if your system is affected by reviewing kernel logs
dmesg | grep -i "gpiochip_disable_irq"

# Check kernel taint status
cat /proc/sys/kernel/tainted

# Verify current kernel version
uname -r