CVE-2026-43087 Overview
CVE-2026-43087 is a Linux kernel vulnerability in the pinctrl: mcp23s08 driver, which provides pin control support for Microchip MCP23xxx I/O expander chips. The driver fails to disable pin interrupts during probe, allowing a chip with pre-existing interrupt-on-change configuration (for example, after a reboot) to generate interrupts before a nested handler is registered. This results in a null pointer dereference and a kernel oops in _raw_spin_lock_irq invoked from mcp23s08_irq. The issue became reachable after commit f9f4fda15e72 ("pinctrl: mcp23s08: init reg_defaults from HW at probe and switch cache type") changed regmap behavior so the real MCP_GPINTEN value is read from hardware.
Critical Impact
A spurious interrupt during driver probe triggers a kernel crash on systems using MCP23xxx GPIO expanders, causing local denial of service.
Affected Products
- Linux kernel versions containing commit f9f4fda15e72 prior to the fix
- Systems using the pinctrl-mcp23s08 driver with Microchip MCP23xxx I/O expanders
- Embedded platforms such as the Khadas VIM3 referenced in the crash trace
Discovery Timeline
- 2026-05-06 - CVE-2026-43087 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43087
Vulnerability Analysis
The vulnerability resides in the mcp23s08 pinctrl driver responsible for managing Microchip GPIO expander pin control and interrupt handling. During driver probe, the code does not clear the MCP_GPINTEN register, which controls interrupt-on-change for individual pins. If the chip retains a non-zero MCP_GPINTEN value from a prior boot or firmware state, the chip can raise an interrupt before the kernel has registered nested IRQ handlers for the affected pins.
When the parent IRQ thread mcp23s08_irq processes such an interrupt, it calls handle_nested_irq for a child IRQ that has no associated irq_desc action. The handler then dereferences an invalid pointer at offset 0xac, producing a kernel oops with Unable to handle kernel read from unreadable memory at virtual address 00000000000000ac. The crash trace shows the fault occurring in _raw_spin_lock_irq called from handle_nested_irq.
Root Cause
The root cause is a missing initialization step in the probe path. Prior to commit f9f4fda15e72, the regmap layer cached a default 0 for MCP_GPINTEN, masking the issue. After that commit, the driver reads the actual register value from hardware, exposing any pre-enabled interrupt sources before nested handlers are wired up. This is a kernel driver initialization defect leading to a null pointer dereference [CWE-476].
Attack Vector
The trigger is local and physical or environmental rather than network-based. An attacker or normal operating condition that leaves MCP_GPINTEN enabled across reboots, such as a warm reset or external signal asserting an interrupt during boot, will cause the kernel to crash during driver probe. The fix disables all pin interrupts during initialization so the chip cannot raise interrupts before handlers are registered.
No verified exploit code is publicly available. See the Linux kernel commit reference and the companion stable commit for the patch.
Detection Methods for CVE-2026-43087
Indicators of Compromise
- Kernel oops messages referencing mcp23s08_irq+0x248/0x358 and _raw_spin_lock_irq in the call trace
- Unable to handle kernel read from unreadable memory at virtual address 00000000000000ac in dmesg during early boot
- Repeated boot failures or panics on systems using MCP23xxx GPIO expanders shortly after probe of the pinctrl-mcp23s08 driver
Detection Strategies
- Monitor kernel ring buffer and journald for oops signatures originating from the pinctrl-mcp23s08 module
- Inventory devices using mcp23s08, mcp23x08, or mcp23x17 device-tree compatibles to identify exposed hosts
- Correlate boot-time crashes with kernel versions containing commit f9f4fda15e72 but lacking the fix
Monitoring Recommendations
- Forward kernel logs from embedded and edge Linux systems to a centralized logging or SIEM platform for crash trace analysis
- Track kernel package versions across the fleet and flag hosts running affected kernels with MCP23xxx hardware
- Configure watchdog and kdump to capture crash dumps for post-incident review
How to Mitigate CVE-2026-43087
Immediate Actions Required
- Apply the upstream fix that disables all pin interrupts during mcp23s08 probe by clearing MCP_GPINTEN before handler registration
- Update affected Linux kernels to a stable release that includes commits db5b8cecbdf4 and f8c3258541a0
- Identify systems using MCP23xxx I/O expanders and prioritize patching for those hosts
Patch Information
The upstream fix initializes the MCP_GPINTEN register to 0 during driver probe, ensuring no pin interrupts can fire before nested handlers are registered. Refer to the Linux kernel mainline commit and the stable backport commit for the authoritative patch.
Workarounds
- If patching is not immediately possible, blacklist the pinctrl-mcp23s08 module on systems where MCP23xxx hardware is not required
- Perform a full power cycle rather than a warm reboot to clear residual MCP_GPINTEN state on the expander chip
- Revert to a kernel predating commit f9f4fda15e72 only as a temporary measure, accepting the loss of the cache fix it provides
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
