CVE-2026-64230: Linux Kernel TPS65219 IRQ Vulnerability

CVE-2026-64230 Overview

CVE-2026-64230 is a Linux kernel vulnerability in the tps65219 regulator driver. A prior cleanup commit removed the tps65219_get_rdev_by_name() helper along with the irq_data.rdev assignment that depended on it. This left irq_data.rdev uninitialized for all interrupt requests (IRQs) registered by the driver. When regulator_notifier_call_chain() is invoked from the IRQ handler, the kernel dereferences the uninitialized pointer and triggers a NULL pointer dereference [CWE-476], producing an Oops: 0000000096000004 kernel fault.

Critical Impact
Systems using the Texas Instruments TPS65219 power management IC (PMIC) crash when the regulator IRQ fires, resulting in a denial of service on affected embedded and industrial Linux devices.

Affected Products

Linux kernel builds including the regulator: tps65219 driver after commit 64a6b577490c ("regulator: tps65219: Remove debugging helper function")
Stable kernel branches prior to the fix commits 6827647fd2dc, b986f88b22a5, and f9b2d3b703d1
Embedded platforms using the Texas Instruments TPS65219 PMIC (commonly AM62x / Sitara-based systems)

Discovery Timeline

2026-07-24 - CVE-2026-64230 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64230

Vulnerability Analysis

The tps65219 regulator driver registers nested threaded IRQs for PMIC events such as under-voltage, over-current, sensor, and timeout conditions. Each IRQ callback receives a struct tps65219_irq_data that includes an rdev field pointing back to the associated regulator device. The IRQ handler passes this pointer to regulator_notifier_call_chain() so subscribers can react to hardware events on a specific regulator.

After the cleanup commit 64a6b577490c removed tps65219_get_rdev_by_name(), no code path assigned irq_data.rdev. The field remained uninitialized for every registered IRQ. When the PMIC raised an interrupt, tps65219_regulator_irq_handler() forwarded the stale pointer to regulator_notifier_call_chain(), producing the observed kernel Oops with a call trace through handle_nested_irq, regmap_irq_thread, and irq_thread_fn.

Root Cause

The root cause is a missing initialization introduced during a refactor. The auxiliary lookup that populated irq_data.rdev was deleted, but the IRQ handler still expected the field to point to a valid struct regulator_dev. Non-regulator IRQs such as SENSOR and TIMEOUT also have no corresponding regulator, so any handler path can dereference the uninitialized pointer.

Attack Vector

This is a local reliability vulnerability rather than a remote exploitation primitive. Any PMIC interrupt event on affected hardware triggers the fault. On embedded devices this can be induced by normal operational conditions such as thermal transients, load spikes, or sensor timeouts, causing repeatable denial of service. The Exploit Prediction Scoring System (EPSS) score is 0.166% (percentile 6.29), reflecting the low likelihood of weaponized exploitation.

The upstream fix restructures the probe function to combine regulator registration with IRQ registration in the same loop, so the rdev returned by devm_regulator_register() is directly assigned to irq_data.rdev. Non-regulator IRQs are registered with rdev=NULL, and the handler adds a NULL check to prevent dereference.

Detection Methods for CVE-2026-64230

Indicators of Compromise

Kernel Oops entries in dmesg or journalctl -k referencing regulator_notifier_call_chain and tps65219_regulator_irq_handler in the call trace
Unexpected reboots or system hangs on devices using the TPS65219 PMIC, particularly during power state transitions
Fault code Oops: 0000000096000004 (synchronous data abort from lower EL, translation fault) on ARM64 kernels running the affected driver

Detection Strategies

Inventory kernel builds and identify systems shipping the tps65219 regulator driver without the fix commits 6827647fd2dc, b986f88b22a5, or f9b2d3b703d1 applied
Correlate hardware watchdog resets and kernel panics against boards populated with the TPS65219 PMIC
Monitor stable branch backports and vendor board support package (BSP) release notes for inclusion of the fix

Monitoring Recommendations

Forward kernel logs from embedded and edge Linux devices to a centralized log store and alert on repeated Oops events referencing regulator or IRQ handler symbols
Track fleet-wide crash telemetry from field devices to detect regression clusters after kernel updates
Verify running kernel version and driver git hash during device health checks

How to Mitigate CVE-2026-64230

Immediate Actions Required

Apply the upstream fix commits (6827647fd2dc, b986f88b22a5, f9b2d3b703d1) or update to a stable Linux kernel release that includes them
Rebuild and redeploy firmware images for embedded devices using the TPS65219 PMIC
If patching is deferred, evaluate whether the tps65219 driver can be disabled or unbound on non-essential systems until an update is available

Patch Information

The fix restructures the tps65219 regulator probe function so that IRQ registration occurs in the same loop as regulator registration. The rdev returned by devm_regulator_register() is assigned directly to irq_data.rdev, eliminating the uninitialized pointer. The IRQ handler now checks for rdev == NULL before calling regulator_notifier_call_chain(), safely handling non-regulator IRQs such as SENSOR and TIMEOUT. See the upstream commits: Kernel Git Commit 6827647, Kernel Git Commit b986f88, and Kernel Git Commit f9b2d3b.

Workarounds

Disable the CONFIG_REGULATOR_TPS65219 kernel option on builds where the PMIC is not required at runtime, then rebuild the kernel
Mask or gate PMIC interrupt sources at the device tree or firmware level on lab systems to prevent handler invocation until the patch lands
Constrain workloads that trigger frequent PMIC interrupts (thermal cycling, aggressive DVFS transitions) on unpatched devices

bash

# Verify whether the tps65219 driver is loaded and inspect kernel version
uname -r
lsmod | grep tps65219
dmesg | grep -iE 'tps65219|regulator_notifier_call_chain'

# Optional: unbind the driver on a running system (test in a controlled environment)
echo -n "<i2c-device-id>" | sudo tee /sys/bus/i2c/drivers/tps65219-regulator/unbind