CVE-2026-64238: Linux Kernel Race Condition Vulnerability

CVE-2026-64238 Overview

CVE-2026-64238 affects the Linux kernel's General Purpose Input/Output (GPIO) subsystem. The vulnerability is a deadlock condition in the shared GPIO proxy code path. It was introduced by commit 710abda58055 ("gpio: shared: call gpio_chip::of_xlate() if set"), which widened a critical section protected by the mutex embedded in struct gpio_shared_entry. When the shared GPIO proxy's parent is removed, the oversized critical section can lead to a deadlock inside the kernel. The fix narrows the critical section so the mutex only protects reads of the offset field.

Critical Impact
The deadlock can hang kernel threads that manage shared GPIO resources during device removal, resulting in denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing commit 710abda58055 in the shared GPIO proxy driver
Downstream Linux distributions shipping the affected gpio: shared code
Embedded and industrial Linux systems relying on shared GPIO proxies

Discovery Timeline

2026-07-24 - CVE-2026-64238 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64238

Vulnerability Analysis

The defect lives in the Linux kernel gpio: shared driver. The introducing commit expanded the scope of a mutex embedded in struct gpio_shared_entry to protect an offset field that becomes mutable after assignment. The critical section grew large enough that code paths executed under the lock could re-enter or wait on resources also held during parent device removal. This ordering violation creates a deadlock condition [CWE-833] when the shared GPIO proxy's parent chip is unregistered. The remediation reduces the critical section so the mutex only covers reads of offset, restoring safe lock ordering.

Root Cause

The root cause is an overly broad critical section around the gpio_shared_entry mutex. Holding the lock across operations that interact with parent GPIO chip teardown produced a lock-order inversion. Concurrent removal of the parent device and access through the shared proxy could then wait on each other indefinitely.

Attack Vector

The issue is triggered locally through normal kernel operations that exercise shared GPIO proxies while a parent GPIO controller is removed. Exploitation does not provide code execution. The observed impact is a hang of kernel threads holding the affected mutex, producing a denial-of-service condition on the host. No public proof-of-concept exploit is available for CVE-2026-64238.

No verified exploit code is available. See the upstream kernel commits for the source-level fix details.

Detection Methods for CVE-2026-64238

Indicators of Compromise

Kernel task hangs or hung_task warnings referencing gpio_shared_entry or GPIO proxy code paths
lockdep reports flagging inverted lock acquisition around shared GPIO mutexes
Stalled processes blocked on GPIO ioctl or sysfs operations during device hot-unplug

Detection Strategies

Enable CONFIG_LOCKDEP and CONFIG_DETECT_HUNG_TASK in kernel builds to surface deadlock conditions during testing
Inventory running kernel versions and compare against the fixed commits a1b836607304f71051f9f9dcccf8b5097b86a1fb and a554dfcd30dd5e41d1d67387b3bb85cea83e12e1
Correlate GPIO subsystem stack traces from dmesg with parent controller removal events

Monitoring Recommendations

Ship kernel logs (dmesg, journalctl -k) to a centralized logging platform and alert on hung_task, INFO: task blocked, and lockdep entries
Track uptime and unexpected reboots on embedded Linux fleets that use shared GPIO proxies
Monitor package versions across Linux hosts to confirm the patched kernel is installed

How to Mitigate CVE-2026-64238

Immediate Actions Required

Identify Linux systems running kernels that include commit 710abda58055 but not the fix commits
Apply the upstream stable kernel updates that contain a1b836607304f71051f9f9dcccf8b5097b86a1fb and a554dfcd30dd5e41d1d67387b3bb85cea83e12e1
Schedule reboots on affected hosts to load the patched kernel image

Patch Information

The Linux kernel maintainers fixed the deadlock by narrowing the critical section so the gpio_shared_entry mutex protects only reads of the offset field. The documentation for the structure was updated to note that the entry lock also guards concurrent access to offset. See the Kernel Git Commit Reference (a1b8366) and the Kernel Git Commit Reference (a554dfc).

Workarounds

Avoid hot-removing the parent GPIO controller while shared GPIO proxies are actively in use
Restrict access to userspace interfaces that trigger shared GPIO proxy operations on unpatched hosts
Where feasible, disable or unload the gpio: shared proxy driver until the patched kernel can be deployed

bash

# Verify running kernel version and check for the fix
uname -r
# On Debian/Ubuntu
apt list --installed 2>/dev/null | grep linux-image
# On RHEL/Fedora
rpm -qa | grep kernel
# Review recent GPIO-related kernel messages
dmesg | grep -iE 'gpio|hung_task|lockdep'