CVE-2026-53226: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53226 Overview

CVE-2026-53226 affects the Linux kernel gpio-rockchip driver. The driver allocates domain generic IRQ chips during probe using irq_alloc_domain_generic_chips(), but fails to free them when the driver is removed. The IRQ domain flags omit IRQ_DOMAIN_FLAG_DESTROY_GC, so the generic chips remain on the global gc_list after the GPIO bank is gone. Subsequent generic IRQ chip suspend, resume, or shutdown callbacks can then access freed memory, producing a use-after-free [CWE-416] and potential kernel crash. The issue is resolved by explicitly calling irq_domain_remove_generic_chips() in rockchip_gpio_remove().

Critical Impact
Use-after-free during suspend, resume, or shutdown callbacks after GPIO bank removal may lead to kernel memory corruption and a system crash on affected Rockchip-based Linux platforms.

Affected Products

Linux kernel gpio-rockchip driver
Rockchip SoC-based platforms using the in-tree GPIO driver
Stable kernel branches receiving the referenced backport commits

Discovery Timeline

2026-06-25 - CVE CVE-2026-53226 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53226

Vulnerability Analysis

The gpio-rockchip driver manages GPIO banks on Rockchip SoCs and registers an IRQ domain for the bank's interrupt lines. During probe, it calls irq_alloc_domain_generic_chips() to allocate the domain's generic IRQ chip structures. These structures are tracked on a global gc_list consulted by the generic IRQ chip framework for power management callbacks.

When the driver is unbound or the module is removed, rockchip_gpio_remove() tears down the IRQ domain. However, the domain was registered without the IRQ_DOMAIN_FLAG_DESTROY_GC flag, so the IRQ core does not automatically release the generic chips attached to that domain. The chip structures remain referenced from gc_list even though their backing GPIO bank is gone.

Later, when the kernel walks gc_list to invoke irq_gc_suspend(), irq_gc_resume(), or irq_gc_shutdown(), it dereferences chip pointers whose underlying memory and device context have been freed. This produces a memory leak in the steady state and a use-after-free condition during power state transitions or shutdown.

Root Cause

The root cause is missing teardown of generic IRQ chips on driver removal. The driver does not set IRQ_DOMAIN_FLAG_DESTROY_GC on its IRQ domain and does not manually call irq_domain_remove_generic_chips() before irq_domain_remove(). The allocation and free paths are asymmetric, leaving stale entries on the global gc_list.

Attack Vector

Triggering the flaw requires the ability to unbind or remove the gpio-rockchip driver and then induce a system suspend, resume, or shutdown event. This is a local, privileged operation on affected Rockchip platforms. There is no public exploit, no CISA KEV listing, and EPSS is 0.173%. The practical impact is a kernel stability issue rather than a remote attack primitive.

The fix adds an explicit call to irq_domain_remove_generic_chips() in rockchip_gpio_remove() before the IRQ domain is removed, ensuring the generic chips are unlinked from gc_list and freed. See the upstream commits at kernel.org commit 1c1e0fc8, commit 1f34ea5f, and commit bace7b99 for the patch details.

Detection Methods for CVE-2026-53226

Indicators of Compromise

Kernel oops or panic logs referencing irq_gc_suspend, irq_gc_resume, or irq_gc_shutdown shortly after gpio-rockchip removal or unbind
KASAN use-after-free reports involving generic IRQ chip structures on Rockchip platforms
Kmemleak reports flagging unfreed allocations originating from irq_alloc_domain_generic_chips() in the GPIO driver path

Detection Strategies

Enable CONFIG_KASAN and CONFIG_DEBUG_KMEMLEAK in test kernels to surface the leak and use-after-free during driver unbind and PM cycles
Audit dmesg and persistent kernel logs for stack traces tying GPIO bank removal to subsequent IRQ chip callbacks
Compare running kernel versions against the fixed stable releases referenced in the upstream commits

Monitoring Recommendations

Forward kernel logs from Rockchip-based fleet devices to a central log pipeline and alert on BUG:, Oops:, and KASAN markers tied to IRQ subsystem symbols
Track suspend, resume, and shutdown failure rates on affected hardware to spot regressions introduced by the unfixed driver
Maintain an inventory of kernel build versions per device class to identify hosts that still ship the vulnerable gpio-rockchip driver

How to Mitigate CVE-2026-53226

Immediate Actions Required

Update affected systems to a Linux stable release that includes the upstream fix commits referenced in the NVD entry
Avoid unbinding or removing the gpio-rockchip driver on production Rockchip systems running unpatched kernels
Restrict access to root and module management capabilities so unprivileged users cannot trigger driver teardown

Patch Information

The upstream fix adds irq_domain_remove_generic_chips() to rockchip_gpio_remove() so the domain's generic chips are released before the IRQ domain itself is torn down. The corrected behavior is captured in kernel.org commit 1c1e0fc8, commit 1f34ea5f, and commit bace7b99. Rebuild and deploy distribution kernels that incorporate these stable backports.

Workarounds

Keep the gpio-rockchip driver permanently bound and do not blacklist or unload it on running systems
Disable user-initiated suspend and shutdown paths on devices where the driver may have been unbound until a patched kernel is installed
Pin module loading policy so the driver cannot be removed by non-root processes or automation

bash

# Verify the running kernel and confirm the gpio-rockchip driver state
uname -r
ls /sys/bus/platform/drivers/ | grep -i rockchip_gpio

# Prevent accidental unbind of the driver (example for one device path)
chmod 0400 /sys/bus/platform/drivers/rockchip_gpio/unbind