CVE-2026-64241: Linux Kernel Privilege Escalation Flaw

CVE-2026-64241 Overview

CVE-2026-64241 is a Linux kernel vulnerability in the Rockchip GPIO driver (gpio-rockchip). The flaw involves multiple teardown bugs and resource leaks in the driver's remove path and error handling routines. Affected areas include a debounce clock reference leak, an unregistered chained interrupt request (IRQ) handler, and an IRQ domain leak. When the driver is removed, stale handlers and unfreed resources remain in kernel memory. A stray interrupt fired after driver removal can invoke a stale handler, resulting in a kernel panic and denial of service.

Critical Impact
Improper cleanup in the Rockchip GPIO driver can leave stale IRQ handlers and unreleased kernel resources, leading to kernel panic when stray interrupts occur after driver unbind.

Affected Products

Linux kernel gpio-rockchip driver
Rockchip SoC-based platforms using kernel-managed GPIO controllers
Downstream distributions shipping affected kernel revisions

Discovery Timeline

2026-07-24 - CVE CVE-2026-64241 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64241

Vulnerability Analysis

The Rockchip GPIO driver contains three distinct cleanup defects that manifest during driver unbind or probe failure. Each defect leaks a kernel resource or leaves dangling state that can be reached after driver removal.

The first issue is a debounce clock reference leak. The driver obtains bank->db_clk via of_clk_get(), which increments the clock's reference count. The driver never calls clk_put(), so the reference count remains elevated after unbind. Fixing this requires registering a device-managed (devm) action to release the clock cleanly.

The second issue is an unregistered chained IRQ handler. The chained handler installed during probe is not disconnected in remove(). Any stray interrupt arriving after removal invokes a stale function pointer, producing a kernel panic.

The third issue is an IRQ domain leak. The linear IRQ domain and its generic chips are allocated manually during probe but never freed. Removing the driver without tearing down the domain leaks generic chips and IRQ mappings.

Root Cause

The root cause is incomplete resource management in the probe and remove paths. The driver mixes manual allocation with lifecycle assumptions that no longer hold when unbind or error unwind occurs. of_clk_get(..., 1) is required over devm_clk_get() because the device tree binding does not define clock-names, precluding name-based lookup.

Attack Vector

Exploitation requires the ability to trigger driver unbind or probe failure on an affected Rockchip platform. This is a local kernel-level defect. An attacker with sufficient privileges to unbind the driver, or a hardware condition producing stray GPIO interrupts after removal, can trigger a kernel panic. The result is a denial of service against the host.

No verified public exploit code is available. See the upstream commits for technical fix details:

Detection Methods for CVE-2026-64241

Indicators of Compromise

Kernel panic messages referencing gpio-rockchip or stale IRQ handler invocation shortly after driver unbind
dmesg entries showing GPIO interrupt handling on a removed device
Elevated clock reference counts on Rockchip GPIO banks persisting across driver reload

Detection Strategies

Monitor kernel logs for panics or Oops traces that name the Rockchip GPIO driver or its IRQ handlers.
Audit installed kernel versions across Rockchip-based fleet devices and compare against patched stable branches.
Track driver bind and unbind events through kernel audit subsystems on production Rockchip hardware.

Monitoring Recommendations

Centralize kernel log collection from Rockchip endpoints and alert on GPIO subsystem panic signatures.
Include kernel version inventory in configuration management to identify hosts running vulnerable builds.
Watch for unexpected reboots or watchdog resets on embedded devices where the GPIO driver is dynamically managed.

How to Mitigate CVE-2026-64241

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry to all Rockchip-based systems.
Restrict privileged operations that can trigger driver unbind on production hosts.
Validate that vendor-supplied kernels for Rockchip boards incorporate the fix set before deploying updates.

Patch Information

The fix is committed to the mainline Linux kernel and stable branches. The patch registers a devm action to release bank->db_clk, clears the chained IRQ handler in remove(), and tears down the linear IRQ domain during driver unbind. Refer to the linked stable commits for the exact source changes and backport targets.

Workarounds

Avoid dynamically unbinding the gpio-rockchip driver on running systems until patched kernels are deployed.
Restrict access to sysfs unbind interfaces (/sys/bus/platform/drivers/gpio-rockchip/unbind) to root only, following least-privilege policies.
Where feasible, build the driver as built-in rather than loadable to reduce the practical exposure of the remove path.

bash

# Restrict access to platform driver unbind interfaces
chmod 600 /sys/bus/platform/drivers/gpio-rockchip/unbind
chmod 600 /sys/bus/platform/drivers/gpio-rockchip/bind

# Verify running kernel version against patched stable releases
uname -r