{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-23308 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-23308 is a medium-severity denial of service vulnerability in Linux kernel, published on 25 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-23308 and fix it if it is affected.\n\nWhat it is: CVE-2026-23308 is a medium-severity denial of service vulnerability in Linux kernel, published on 25 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-23308 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-23308/ (Markdown: https://insights.sbomify.com/CVE-2026-23308/index.md)","id":"CVE-2026-23308","markdown":"https://insights.sbomify.com/CVE-2026-23308/index.md","name":"CVE-2026-23308","record":{"aliases":["BELL-CVE-2026-23308","DEBIAN-CVE-2026-23308","GHSA-j35c-6rvp-p2rf","ROOT-OS-DEBIAN-13-CVE-2026-23308","ROOT-OS-UBUNTU-2404-CVE-2026-23308","UBUNTU-CVE-2026-23308"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel driver","requires_auth":"low_privilege","summary":"A logic error in the Linux kernel pinctrl driver causes excessive warning traces on load, potentially leading to log flooding and resource exhaustion.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":5.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: equilibrium: fix warning trace on load\n\nThe callback functions 'eqbr_irq_mask()' and 'eqbr_irq_ack()' are also\ncalled in the callback function 'eqbr_irq_mask_ack()'. This is done to\navoid source code duplication. The problem, is that in the function\n'eqbr_irq_mask()' also calles the gpiolib function 'gpiochip_disable_irq()'\n\nThis generates the following warning trace in the log for every gpio on\nload.\n\n[    6.088111] ------------[ cut here ]------------\n[    6.092440] WARNING: CPU: 3 PID: 1 at drivers/gpio/gpiolib.c:3810 gpiochip_disable_irq+0x39/0x50\n[    6.097847] Modules linked in:\n[    6.097847] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Tainted: G        W          6.12.59+ #0\n[    6.097847] Tainted: [W]=WARN\n[    6.097847] RIP: 0010:gpiochip_disable_irq+0x39/0x50\n[    6.097847] Code: 39 c6 48 19 c0 21 c6 48 c1 e6 05 48 03 b2 38 03 00 00 48 81 fe 00 f0 ff ff 77 11 48 8b 46 08 f6 c4 02 74 06 f0 80 66 09 fb c3 \u003c0f\u003e 0b 90 0f 1f 40 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40\n[    6.097847] RSP: 0000:ffffc9000000b830 EFLAGS: 00010046\n[    6.097847] RAX: 0000000000000045 RBX: ffff888001be02a0 RCX: 0000000000000008\n[    6.097847] RDX: ffff888001be9000 RSI: ffff888001b2dd00 RDI: ffff888001be02a0\n[    6.097847] RBP: ffffc9000000b860 R08: 0000000000000000 R09: 0000000000000000\n[    6.097847] R10: 0000000000000001 R11: ffff888001b2a154 R12: ffff888001be0514\n[    6.097847] R13: ffff888001be02a0 R14: 0000000000000008 R15: 0000000000000000\n[    6.097847] FS:  0000000000000000(0000) GS:ffff888041d80000(0000) knlGS:0000000000000000\n[    6.097847] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[    6.097847] CR2: 0000000000000000 CR3: 0000000003030000 CR4: 00000000001026b0\n[    6.097847] Call Trace:\n[    6.097847]  \u003cTASK\u003e\n[    6.097847]  ? eqbr_irq_mask+0x63/0x70\n[    6.097847]  ? no_action+0x10/0x10\n[    6.097847]  eqbr_irq_mask_ack+0x11/0x60\n\nIn an other driver (drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c) the\ninterrupt is not disabled here.\n\nTo fix this, do not call the 'eqbr_irq_mask()' and 'eqbr_irq_ack()'\nfunction. Implement instead this directly without disabling the interrupts.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"pinctrl: equilibrium: fix warning trace on load","id":"CVE-2026-23308","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"tracing: Add NULL pointer check to trigger_data_free()","id":"CVE-2026-23309"},"packages":[],"prev":{"headline":"can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message","id":"CVE-2026-23307"},"products":["Linux"],"published":"2026-03-25","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A logic error in the Linux kernel pinctrl driver causes excessive warning traces on load, potentially leading to log flooding and resource exhaustion.","url":"https://insights.sbomify.com/CVE-2026-23308/"}