CVE-2026-64521 Overview
CVE-2026-64521 is a deadlock vulnerability in the Linux kernel's Amlogic A4 pin controller driver (pinctrl: meson: amlogic-a4). Accessing the pinconf-pins sysfs node triggers a recursive mutex acquisition that halts the affected thread. The function pinconf_pins_show() holds pctldev->mutex, and the platform driver then calls pinctrl_find_gpio_range_from_pin(), which attempts to acquire the same mutex. The fix replaces the call with pinctrl_find_gpio_range_from_pin_nolock() to avoid the recursive lock.
Critical Impact
Local users with access to the pinconf-pins sysfs interface can trigger a kernel deadlock, resulting in denial of service on affected Amlogic A4 platforms.
Affected Products
- Linux kernel builds including the pinctrl-meson-amlogic-a4 driver
- Amlogic A4-based hardware platforms using the mainline pin controller
- Distributions shipping unpatched stable kernels prior to the referenced commits
Discovery Timeline
- 2026-07-25 - CVE-2026-64521 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64521
Vulnerability Analysis
The defect is a classic deadlock caused by recursive acquisition of a non-recursive mutex. When a user reads the debug sysfs node pinconf-pins, the kernel invokes pinconf_pins_show(). That function acquires pctldev->mutex before iterating over pin configuration entries. During the callback into the Amlogic A4 platform driver, control flows into pinctrl_find_gpio_range_from_pin(), which itself locks pctldev->mutex. Because the mutex is already held by the caller in the same thread, the second acquisition blocks indefinitely. The affected task stalls, and any subsequent operations that require the same lock queue behind it. The maintainers resolved the issue by switching the platform driver to pinctrl_find_gpio_range_from_pin_nolock(), the lock-free variant intended for callers that already hold pctldev->mutex.
Root Cause
The root cause is improper lock discipline in the Amlogic A4 pin controller callback path. The driver called a lock-taking helper from a context where the same lock was already held, violating the pinctrl subsystem's locking contract.
Attack Vector
Exploitation requires local access to the affected system and read permission on the pinconf-pins debug sysfs node, which is typically restricted to privileged users. A local user or process able to read that node on an Amlogic A4 device triggers the deadlock, producing a denial-of-service condition on the pinctrl subsystem and any threads dependent on it.
No verified public exploit code is available. Refer to the upstream commits for the exact change:
Detection Methods for CVE-2026-64521
Indicators of Compromise
- Processes stuck in uninterruptible sleep (D state) when reading /sys/kernel/debug/pinctrl/*/pinconf-pins on Amlogic A4 hardware.
- Kernel hung task warnings referencing pinconf_pins_show and pinctrl_find_gpio_range_from_pin in dmesg output.
- Lockdep splats reporting recursive acquisition of pctldev->mutex.
Detection Strategies
- Enable CONFIG_LOCKDEP and CONFIG_DEBUG_MUTEXES on test kernels to surface recursive locking during QA.
- Monitor dmesg and kernel logs for hung_task_timeout_secs warnings tied to pinctrl call stacks.
- Track kernel package versions against the patched stable releases referenced in the upstream commits.
Monitoring Recommendations
- Alert on repeated tasks blocking in pinctrl_find_gpio_range_from_pin via existing host telemetry.
- Collect and centralize kernel logs from Amlogic A4 devices to catch deadlock signatures early.
- Audit which local accounts or services read pinctrl debug sysfs nodes and restrict where possible.
How to Mitigate CVE-2026-64521
Immediate Actions Required
- Update to a stable Linux kernel that includes the referenced commits 744ac926c0e5, e72ce0298103, or e917713f0134.
- Restrict access to /sys/kernel/debug/pinctrl/ on Amlogic A4 devices until patches are deployed.
- Rebuild and redeploy custom kernels for embedded Amlogic A4 platforms with the fixed pinctrl driver.
Patch Information
The fix replaces pinctrl_find_gpio_range_from_pin() with pinctrl_find_gpio_range_from_pin_nolock() in the Amlogic A4 platform driver. It is available in the upstream stable tree via commits 744ac926c0e55267a10b49b5b72582afef4ad49f, e72ce029810390eb987a036fb2c8a5da9a23b685, and e917713f013423069782ff554935c7a5d4266783. Apply the vendor kernel update that incorporates these commits.
Workarounds
- Ensure debugfs is not mounted, or mount it with restrictive permissions so unprivileged users cannot read pinconf-pins.
- Disable or unload the pinctrl-meson-amlogic-a4 module on systems where it is not required.
- Limit shell access on affected embedded devices to trusted administrators pending patch rollout.
# Configuration example: restrict debugfs access until patched
mount -o remount,mode=0700 /sys/kernel/debug
chown root:root /sys/kernel/debug
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
