PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45868 Linux CVE debrief

A reference-count leak vulnerability exists in the Linux kernel's pinctrl-single driver. The function `pcs_add_gpio_func()` in `drivers/pinctrl/pinctrl-single.c` calls `of_parse_phandle_with_args()`, which returns a `device_node` pointer with an incremented reference count in `gpiospec.np`. The code iterates through all GPIO phandles but fails to release these references, causing a reference-count leak on each iteration. Additionally, the error path when `devm_kzalloc()` fails also lacks proper cleanup. This bug was detected by static analysis and verified through code review. The vulnerability could lead to resource exhaustion over time as leaked references accumulate. Multiple stable kernel branches have received patches to address this issue.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators, embedded device manufacturers using pinctrl-single for GPIO control, kernel maintainers, and security teams tracking kernel-level resource exhaustion vulnerabilities

Technical summary

The pinctrl-single driver in the Linux kernel contains a reference-count leak in `pcs_add_gpio_func()`. When parsing GPIO device tree phandles via `of_parse_phandle_with_args()`, the returned `device_node` references are never released with `of_node_put()`. This occurs both in the normal iteration loop and in the error path when memory allocation fails. The leak accumulates with each GPIO phandle processed, potentially leading to resource exhaustion. The fix adds proper `of_node_put()` calls in both locations.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches as referenced in the CVE record
  • Monitor kernel stable updates for your distribution
  • Review systems using pinctrl-single driver for GPIO functionality
  • Consider rebooting systems after kernel updates to ensure patched code is active

Evidence notes

The vulnerability description is sourced from the official CVE record published 2026-05-27. The fix involves adding `of_node_put()` calls to release device_node references after argument extraction and on the `devm_kzalloc()` failure path. Eight kernel.org stable commit references are provided, indicating backports to multiple kernel versions. No CVSS score or severity rating is currently assigned (status: Awaiting Analysis).

Official resources

2026-05-27