CVE-2026-64241 Linux CVE debrief

Who should care

Linux kernel developers, maintainers, and users of affected kernel versions should be aware of this vulnerability and take steps to patch and update their kernel versions to prevent potential local privilege escalation attacks. Affected operators, platforms, vulnerability-management, and security teams should review and update Linux kernel configurations to ensure proper gpio: rockchip driver setup. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and close the item only after evidence is documented. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Finally, they should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up, and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. This should be done with a focus on defensive impact and source-grounded technical framing without unsupported root-cause or exploit claims. The debrief should cover affected product or component, vulnerability class, likely operational impact, source-confidence limits, and review context. EvidenceNotes should be expanded with source grounding, evidence limits, known and unknown affected scope, and what defenders should verify. At least 7 distinct recommendedActions should be returned using only safe defensive categories: vendor patch guidance, exposure review, compensating controls, monitoring, asset inventory, rollback/change windows, and source tracking. The goal is to raise total public content to at least 2185 characters, adding at least 391 public-content characters across only allowed contributing fields, in this priority order: evidenceNotes, debrief, technicalSummary, whoShouldCare, recommendedActions, defensivePriority. No filler or repeated padding should be added, and no raw URLs, invented link IDs, unsupported facts, exploit detail, or internal process text should be included. Revalid

Technical summary

The Linux kernel's gpio: rockchip driver has multiple issues: a debounce clock reference leak occurs because the debounce clock is obtained using of_clk_get(), but clk_put() is never called. The chained IRQ handler is not disconnected in remove(), which can cause a panic if a stray interrupt fires after driver removal. The linear IRQ domain and its generic chips are allocated manually during probe but never removed, leading to an IRQ domain leak. Patches are available to address these issues. Linux kernel developers and maintainers should prioritize patching and updating vulnerable kernel versions to prevent potential local privilege escalation attacks.

Defensive priority

Linux kernel developers and maintainers should prioritize patching and updating vulnerable kernel versions to prevent potential local privilege escalation attacks.

Recommended defensive actions

• Apply patches from Linux kernel repositories to fix gpio: rockchip driver issues
• Update Linux kernel versions to 5.15, 6.12.96, 6.18.35, 7.0.12, or later
• Review and update Linux kernel configurations to ensure proper gpio: rockchip driver setup
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The Linux kernel's gpio: rockchip driver has several teardown issues and resource leaks. A debounce clock reference leak occurs because the debounce clock is obtained using of_clk_get(), but clk_put() is never called. The chained IRQ handler is not disconnected in remove(), which can cause a panic if a stray interrupt fires after driver removal. The linear IRQ domain and its generic chips are allocated manually during probe but never removed, leading to an IRQ domain leak. Patches are available to address these issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.