CVE-2026-72063 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
gpio: tegra: do not call pinctrl for GPIO direction
tegra_gpio_direction_input() and tegra_gpio_direction_output() already program the GPIO controller direction registers directly. The additional pinctrl_gpio_direction_input/output() calls do not add a Tegra pinctrl operation, because the Tegra pinmux ops provide GPIO request/free handling but no gpio_set_direction hook.
The extra call still enters the pinctrl core and takes pctldev->mutex. Shared GPIO users can call the direction path while holding their per-line spinlock, so this otherwise redundant pinctrl direction call can sleep in an atomic context.
This was found by our static analysis tool and then confirmed by manual review of tegra_gpio_probe(), the Tegra GPIO direction callbacks and the Tegra pinctrl ops. The reviewed path has a default non-sleeping struct gpio_chip while the direction callback still enters the pinctrl mutex path.
A directed runtime validation kept the same non-sleeping chip registration and drove:
gpio_shared_proxy_direction_output() gpiod_direction_output_raw_commit() tegra_gpio_direction_output() pinctrl_gpio_direction_output()
Lockdep reported a sleep-in-atomic warning with the shared GPIO spinlock held and pinctrl_get_device_gpio_range() plus tegra_gpio_direction_output() on the stack.
Do not mark the whole chip as can_sleep to paper over this: can_sleep describes whether get()/set() may sleep, and Tegra value access is MMIO. Remove the redundant pinctrl direction calls and keep pinctrl involvement in the existing request/free path.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the Linux kernel's Tegra GPIO driver where redundant pinctrl calls create a potential deadlock condition during atomic execution contexts. This issue specifically affects the tegra_gpio_direction_input() and tegra_gpio_direction_output() functions which already directly program GPIO controller direction registers without requiring additional pinctrl operations. The problematic code path includes unnecessary calls to pinctrl_gpio_direction_input() and pinctrl_gpio_direction_output() functions that enter the pinctrl core and acquire pctldev->mutex locks, despite the Tegra pinmux operations providing only GPIO request/free handling without gpio_set_direction hooks.
The technical flaw manifests when shared GPIO users invoke direction changes while holding per-line spinlocks, creating a scenario where the redundant pinctrl direction call can sleep within an atomic context. This violates fundamental kernel concurrency principles and creates potential for system hangs or undefined behavior during GPIO operations. The static analysis tool identified this pattern before manual verification confirmed that tegra_gpio_probe(), Tegra GPIO direction callbacks, and Tegra pinctrl operations all demonstrate a default non-sleeping struct gpio_chip while the direction callback still traverses the pinctrl mutex path.
This vulnerability aligns with CWE-362: Concurrent Execution Using Shared Resource with Unprotected Read-Write Access and maps to ATT&CK technique T1059.003 for privilege escalation through kernel exploitability. The runtime validation confirmed that the stack trace shows gpio_shared_proxy_direction_output(), gpiod_direction_output_raw_commit(), tegra_gpio_direction_output(), and pinctrl_gpio_direction_output() in sequence, with lockdep reporting sleep-in-atomic warnings when the shared GPIO spinlock is held alongside pinctrl_get_device_gpio_range() and tegra_gpio_direction_output() on the call stack. The solution involves removing redundant pinctrl direction calls while maintaining existing request/free path involvement, rather than marking the entire chip as can_sleep which would misrepresent the actual MMIO-based Tegra value access behavior that cannot sleep.
The operational impact includes potential system crashes, deadlocks, and denial of service conditions when GPIO operations occur in atomic contexts. This vulnerability affects systems using Tegra SoCs with shared GPIO configurations where multiple drivers or subsystems may concurrently access the same GPIO lines. The fix ensures proper kernel locking semantics while maintaining functional correctness for GPIO direction changes through direct register manipulation without unnecessary pinctrl overhead.