CVE-2026-64521 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: meson: amlogic-a4: fix deadlock issue
Accessing the pinconf-pins sysfs node may deadlock.
pinconf_pins_show() holds pctldev->mutex, and the platform driver calls pinctrl_find_gpio_range_from_pin(), which tries to acquire the same mutex again, leading to a deadlock.
Use pinctrl_find_gpio_range_from_pin_nolock() to fix this issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability resides within the Linux kernel's pin control subsystem, specifically affecting the amlogic-a4 platform driver implementation. This issue manifests as a deadlock condition that occurs when userspace attempts to access the pinconf-pins sysfs node, which is part of the kernel's pin configuration interface designed to manage GPIO and pin multiplexing settings. The problematic code path demonstrates a classic recursive mutex acquisition pattern where the same synchronization primitive is attempted to be acquired twice by the same execution context.
The technical flaw originates from the improper locking mechanism within the pin control framework. When pinconf_pins_show() function is invoked to display pin configuration information through the sysfs interface, it acquires the pctldev->mutex lock to ensure thread safety during data access. However, this function subsequently calls pinctrl_find_gpio_range_from_pin(), which attempts to acquire the identical mutex lock without releasing the first one. This creates a circular dependency scenario where the same thread is waiting for itself to release a resource it already holds, resulting in an irrecoverable deadlock state that blocks all subsequent pin configuration operations.
The operational impact of this vulnerability extends beyond simple system unresponsiveness as it affects the entire pin control subsystem functionality. Any application or kernel module attempting to query or modify GPIO pin configurations through the sysfs interface becomes blocked indefinitely, potentially rendering embedded systems with amlogic-a4 platform drivers non-responsive to hardware configuration changes. This affects device initialization sequences, runtime GPIO management, and any system components that rely on dynamic pin reconfiguration capabilities. The vulnerability particularly impacts devices such as Android TV boxes, set-top boxes, and other embedded systems utilizing Amlogic SoCs where proper pin control is essential for peripheral functionality.
The mitigation strategy involves implementing a lock-free alternative function that bypasses the problematic mutex acquisition while maintaining functional integrity. By replacing pinctrl_find_gpio_range_from_pin() with pinctrl_find_gpio_range_from_pin_nolock(), the code eliminates the recursive locking scenario without compromising data consistency. This approach aligns with common kernel development practices for avoiding deadlocks in complex subsystems and follows the principle of minimizing lock scope to prevent such issues. The fix specifically addresses the conditions outlined in CWE-362, which describes concurrent execution issues related to improper locking mechanisms.
This vulnerability demonstrates the complexity inherent in kernel-level pin control frameworks where multiple subsystems must coordinate access to shared hardware resources while maintaining strict locking discipline. The issue reflects patterns commonly seen in embedded systems development where platform-specific drivers interact with generic subsystem interfaces, creating potential deadlock scenarios through indirect function calls. The solution approach mirrors ATT&CK technique T1486, which involves leveraging system vulnerabilities to achieve denial of service conditions, though in this case the fix provides a proper resolution rather than exploitation. The patch implementation maintains backward compatibility while resolving the concurrency issue through careful lock management and function call optimization.