CVE-2026-90258 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: airoha: add missed IRQ resource helpers
Without hooking .irq_request_resources, gpiolib cannot set GPIOD_FLAG_USED_AS_IRQ. This breaks pin direction locking and can allow userspace or another driver to reconfigure an active IRQ pin as an output
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's pinctrl subsystem for Airoha SoCs contained a critical implementation gap regarding interrupt resource management, specifically the absence of hooks for .irq_request_resources. This oversight stems from the architectural requirement that gpiolib must explicitly request and validate resources before marking a General Purpose Input/Output pin as an active Interrupt Request line via the GPIOD_FLAG_USED_AS_IRQ flag. Without these specific helper functions implemented within the driver's operations structure, the kernel cannot properly enforce resource ownership or state consistency for pins configured to handle hardware interrupts. This deficiency represents a fundamental failure in adhering to standard GPIO and pinctrl subsystem protocols, which are designed to prevent race conditions and unauthorized configuration changes during active interrupt handling periods.
The technical flaw allows for a dangerous state where an IRQ pin remains logically marked as used but lacks the necessary driver-level locks that would normally prevent external reconfiguration. In practice, this means that userspace applications or other kernel drivers can bypass standard permission checks and alter the direction of a pin currently servicing an interrupt request. By changing the pin configuration from input to output, an attacker or misbehaving software component effectively disables the hardware's ability to detect further edge-triggered events on that line. This action breaks the expected operational model where pins dedicated to interrupts are locked against directional changes until the interrupt is explicitly released by the kernel subsystem.
The operational impact of this vulnerability extends beyond simple functional disruption, introducing significant security and stability risks. An attacker who can reconfigure an active IRQ pin as an output may cause denial-of-service conditions for critical system services that rely on those specific interrupts, such as power management events or hardware monitoring signals. Furthermore, depending on the underlying SoC architecture, forcing a high-impedance input pin to drive a logic level could potentially lead to electrical issues like shoot-through current if multiple drivers are connected to the same net, although modern designs often mitigate this with internal protection diodes. More critically, the ability to silence interrupts can mask security-relevant events or prevent watchdog timers from resetting the system, thereby facilitating persistent attacks that rely on keeping a compromised state active without triggering automatic recovery mechanisms.
This vulnerability aligns closely with CWE-20 Improper Input Validation and CWE-754: Improper Check for Unusual or Exceptional Conditions within the context of resource management. It also relates to ATT&CK technique T1053 Scheduled Task/Job, as an attacker might leverage this flaw to disable monitoring mechanisms that rely on hardware interrupts. To mitigate this issue, system administrators and developers must ensure that the Linux kernel is updated with patches that include the missing .irq_request_resources implementation for Airoha pinctrl drivers. Until such updates are applied, it is advisable to restrict userspace access to GPIO interfaces using strict cgroup or capability restrictions, ensuring that only trusted processes can interact with pin configuration sysfs entries. Additionally, reviewing device tree configurations to minimize the number of pins exposed as general-purpose inputs where interrupts are not strictly required can reduce the attack surface available for exploitation.