PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45868 Linux CVE debrief

A reference-count leak vulnerability exists in the Linux kernel's pinctrl-single driver. The function `pcs_add_gpio_func()` in `drivers/pinctrl/pinctrl-single.c` calls `of_parse_phandle_with_args()`, which returns a `device_node` pointer with an incremented reference count in `gpiospec.np`. The code iterates through all GPIO phandles but fails to release these references, causing a reference-count leak on each iteration. Additionally, the error path when `devm_kzalloc()` fails also lacks proper cleanup. This bug was detected by static analysis and verified through code review. The vulnerability could lead to resource exhaustion over time as leaked references accumulate. Multiple stable kernel branches have received patches to address this issue.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Linux system administrators, embedded device manufacturers using pinctrl-single for GPIO control, kernel maintainers, and security teams tracking kernel-level resource exhaustion vulnerabilities

Technical summary

The pinctrl-single driver in the Linux kernel contains a reference-count leak in `pcs_add_gpio_func()`. When parsing GPIO device tree phandles via `of_parse_phandle_with_args()`, the returned `device_node` references are never released with `of_node_put()`. This occurs both in the normal iteration loop and in the error path when memory allocation fails. The leak accumulates with each GPIO phandle processed, potentially leading to resource exhaustion. The fix adds proper `of_node_put()` calls in both locations.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable branches as referenced in the CVE record
  • Monitor kernel stable updates for your distribution
  • Review systems using pinctrl-single driver for GPIO functionality
  • Consider rebooting systems after kernel updates to ensure patched code is active

Evidence notes

The vulnerability description is sourced from the official CVE record published 2026-05-27. The fix involves adding `of_node_put()` calls to release device_node references after argument extraction and on the `devm_kzalloc()` failure path. Eight kernel.org stable commit references are provided, indicating backports to multiple kernel versions. No CVSS score or severity rating is currently assigned (status: Awaiting Analysis).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45868 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45868

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45868 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45868

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/191bfd5710d6a7f48ba4315d8d3e908dcc15243c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/353353309b0f7afa407df29e455f9d15b5acc296

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3e3b28bb0b6ddc521a4fdd1c1ba0d35017a0796b

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/456a60d06c09a92680dc35fabca68024badcc28e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5b9e84d27e310f22c4ba45fedbc4f5baf43dd823

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7814b1431848854b56717086e2b61bea3c59753d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/99cc7352156c65201c675f750e0e77c4c73d93f5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.