CVE-2026-72062 gpio: mt7621: avoid corruption of shared interrupt trigger state
A race condition in the Linux kernel MT7621 GPIO driver allows concurrent interrupt configuration changes to corrupt shared state, potentially causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72062?
CVE-2026-72062 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
gpio: mt7621: avoid corruption of shared interrupt trigger state
The bank-shared fields like 'rising' and 'falling' are modified using non-atomic read-modify-write operations. Since every gpio chip instance represents an entire bank of 32 pins, if 'mediatek_gpio_irq_type()' is called concurrently for different IRQs on the same bank a possible overwrite of each other's configuration is possible. Thus, protect this state with 'gpio_generic_lock_irqsave' lock in the same way it is handled in irp_chip 'mediatek_gpio_irq_mask()' and 'mediatek_gpio_irq_unmask()' callbacks.
Which versions are affected by CVE-2026-72062?
How do I fix CVE-2026-72062?
Apply the vendor's patch.
Is CVE-2026-72062 being exploited?
There is no known exploitation of CVE-2026-72062 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72062, DEBIAN-CVE-2026-72062, GHSA-hvv6-qvxj-4xmv, UBUNTU-CVE-2026-72062.