CVE-2026-45868: Linux Kernel Privilege Escalation Flaw

CVE-2026-45868 Overview

CVE-2026-45868 is a memory leak vulnerability in the Linux kernel's pinctrl-single driver. The flaw exists in the pcs_add_gpio_func() function, which fails to release device_node references returned by of_parse_phandle_with_args(). Each loop iteration increments the refcount on gpiospec.np without a corresponding of_node_put() call, leaking the reference. The leak also occurs on the error path when devm_kzalloc() fails. The issue was identified through static analysis and verified by manual code review, then resolved upstream across multiple stable kernel branches.

Critical Impact
Repeated invocations of the affected pin controller code path cause persistent device_node refcount leaks that can prevent proper resource cleanup in the Linux kernel.

Affected Products

Linux kernel pinctrl-single driver
Multiple stable kernel branches (fixes backported across 8 commits)
Systems using pinctrl-single with GPIO phandle parsing

Discovery Timeline

2026-05-27 - CVE-2026-45868 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45868

Vulnerability Analysis

The vulnerability resides in pcs_add_gpio_func() within the Linux kernel's pinctrl-single driver. The function iterates through GPIO phandles defined in the device tree using of_parse_phandle_with_args(). This helper returns a device_node pointer in gpiospec.np with its reference count incremented.

The loop reads the required arguments from each phandle but never calls of_node_put() to balance the refcount increment. Over repeated iterations, every parsed phandle contributes an unbalanced reference. The same leak occurs on the error path when the subsequent devm_kzalloc() allocation fails and the function returns without releasing the node reference.

This is a kernel resource leak rather than a remote attack primitive. It does not directly grant code execution or privilege escalation, but it undermines proper device tree lifecycle accounting.

Root Cause

The root cause is missing reference release semantics in iterative device tree parsing. of_parse_phandle_with_args() follows the kernel convention of returning a node with an incremented refcount, transferring ownership to the caller. The original pcs_add_gpio_func() implementation omitted the matching of_node_put() after extracting arguments and on the devm_kzalloc() failure path.

Attack Vector

The issue is triggered through normal kernel initialization when parsing device tree entries for GPIO pin functions in the pinctrl-single driver. There is no documented remote or unprivileged user-triggered path. The leak accumulates each time the affected code executes, contributing to gradual resource exhaustion on systems that repeatedly bind and unbind the affected driver.

The vulnerability is described in prose because no proof-of-concept code is required. The fix consists of inserting of_node_put(gpiospec.np) calls after argument extraction and in the devm_kzalloc() failure branch. See the upstream commits for the exact patch hunks: kernel.org commit 191bfd57 and kernel.org commit 35335330.

Detection Methods for CVE-2026-45868

Indicators of Compromise

No network or runtime indicators are associated with this refcount leak.
Gradual growth in kernel device_node references on systems heavily exercising the pinctrl-single driver.
Kernel warnings related to device tree node lifecycle on long-running embedded systems.

Detection Strategies

Inventory running kernel versions and compare against the patched commits listed in the upstream references.
Use static analyzers such as Coccinelle or Smatch to confirm whether the local kernel tree contains the of_node_put() calls in pcs_add_gpio_func().
Enable CONFIG_DEBUG_KOBJECT and refcount debugging during kernel testing to surface unbalanced references.

Monitoring Recommendations

Track kernel package versions across Linux fleets and flag hosts running unpatched stable branches.
Monitor dmesg for device tree and pinctrl related warnings during driver probe and unbind cycles.
Review vendor kernel release notes for backports of the eight upstream commits associated with this CVE.

How to Mitigate CVE-2026-45868

Immediate Actions Required

Update to a Linux kernel build that includes the upstream fixes for pcs_add_gpio_func().
Identify embedded and IoT devices using pinctrl-single and prioritize them for kernel updates.
Coordinate with hardware vendors and distribution maintainers to obtain backported patches for long-term support kernels.

Patch Information

The fix has been merged across multiple stable branches. Relevant commits include 191bfd57, 35335330, 3e3b28bb, 456a60d0, 5b9e84d2, 7814b143, 99cc7352, and e2e367e5. Apply the kernel update provided by your Linux distribution that incorporates these changes.

Workarounds

No supported runtime workaround exists; the only remediation is applying the kernel patch.
For systems that cannot be patched immediately, avoid repeated bind and unbind cycles of the pinctrl-single driver to slow accumulation of leaked references.
Reboot affected systems on a regular schedule to clear accumulated leaked references until patches can be deployed.

bash

# Verify installed kernel version on a Linux host
uname -r

# Example: update kernel on Debian/Ubuntu systems
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')

# Example: update kernel on RHEL/Fedora systems
sudo dnf update kernel