CVE-2026-53226 gpio: rockchip: fix generic IRQ chip leak on remove
A use-after-free vulnerability in the Rockchip GPIO driver can cause a kernel crash during device removal, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53226?
CVE-2026-53226 is a medium-severity use after free vulnerability in Linux kernel, published on 25 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
gpio: rockchip: fix generic IRQ chip leak on remove
The driver allocates domain generic chips using irq_alloc_domain_generic_chips() during probe. However, on driver remove/teardown, the generic chips are not automatically freed when the IRQ domain is removed because the domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC.
This causes both the domain generic chips structure and the associated generic chips to be leaked. Additionally, the generic chips remain on the global gc_list and may later be visited by generic IRQ chip suspend, resume, or shutdown callbacks after the GPIO bank has been removed, potentially resulting in a use-after-free and kernel crash.
Fix the resource leak by explicitly calling irq_domain_remove_generic_chips() before removing the IRQ domain in rockchip_gpio_remove().
Weakness: CWE-401
Which versions are affected by CVE-2026-53226?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53226?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-53226 being exploited?
There is no known exploitation of CVE-2026-53226 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-90414, BELL-CVE-2026-53226, DEBIAN-CVE-2026-53226, GHSA-fw97-88cp-67m9, ROOT-OS-DEBIAN-12-CVE-2026-53226, ROOT-OS-DEBIAN-13-CVE-2026-53226 and 3 more.