CVE-2026-72063 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and take necessary actions to prevent potential issues. They should verify and apply patches to prevent potential sleep-in-atomic context issues. Reviewing and updating Linux kernel configurations to ensure Tegra GPIO and pinctrl operations are properly handled is also recommended. Additionally, monitoring Linux kernel updates and patches for potential issues related to Tegra GPIO and pinctrl is crucial. Affected product deployments in managed environments should be confirmed and assigned an owner for follow-up. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retested remediated assets, and closed items should be tracked only after evidence is documented. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Planning vendor-supported updates or mitigations through normal change control where exposure is confirmed is also essential. Tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented are critical steps in managing this vulnerability effectively. The vulnerability affects Linux kernel users, particularly those with Tegra GPIO and pinctrl operations, and requires prompt attention to prevent potential issues. Linux kernel users should review compensating controls for exposed systems while remediation is scheduled and verified. Linux kernel users should check relevant monitoring, detection, and logs for exposed assets that need extra review. Linux kernel users should track exceptions, retest remediated assets, and close the item only after evidence is documented. Linux kernel users should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Linux kernel users should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Linux kernel users should plan vendor-supported updates or mitigations, and

Technical summary

The Linux kernel vulnerability CVE-2026-72063 was resolved by removing redundant pinctrl direction calls in the Tegra GPIO driver. The issue caused a sleep-in-atomic context warning due to a mutex lock in an atomic context. The Tegra GPIO driver directly programs the GPIO controller direction registers, making the additional pinctrl calls unnecessary. This change prevents potential sleep-in-atomic context issues in the Linux kernel.

Defensive priority

Linux kernel users should verify and apply patches to prevent potential sleep-in-atomic context issues.

Recommended defensive actions

• Verify Linux kernel version and apply patches to prevent potential sleep-in-atomic context issues.
• Review and update Linux kernel configurations to ensure Tegra GPIO and pinctrl operations are properly handled.
• Monitor Linux kernel updates and patches for potential issues related to Tegra GPIO and pinctrl.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The issue was found by static analysis and confirmed through manual review of tegra_gpio_probe(), Tegra GPIO direction callbacks, and Tegra pinctrl ops. A directed runtime validation and lockdep reported a sleep-in-atomic warning.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.