Linux Kernel up to 7.2-rc5 GPIO PCH spinlock_rt.c pch_irq_type locking

CVSS Meta Temp Score CVSS is a standardized scoring system to determine possibilities of attacks. The Temp Score considers temporal factors like disclosure, exploit and countermeasures. The unique Meta Score calculates the average score of different sources to provide a normalized scoring system.	Current Exploit Price (≈) Our analysts are monitoring exploit markets and are in contact with vulnerability brokers. The range indicates the observed or calculated exploit price to be seen on exploit markets. A good indicator to understand the monetary effort required for and the popularity of an attack.	CTI Interest Score Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. A high score indicates an elevated risk to be targeted for this vulnerability.
6.2	$0-$5k	0.00

Summaryinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.6.150/6.12.102/6.18.43/7.1.7/7.2-rc5. The affected element is the function pch_irq_type of the file kernel/locking/spinlock_rt.c of the component GPIO PCH. Such manipulation leads to locking. This vulnerability is referenced as CVE-2026-74468. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.6.150/6.12.102/6.18.43/7.1.7/7.2-rc5. It has been rated as critical. Affected by this issue is the function pch_irq_type of the file kernel/locking/spinlock_rt.c of the component GPIO PCH. The manipulation with an unknown input leads to a locking vulnerability. Using CWE to declare the problem leads to CWE-667. The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. Impacted is availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: gpio: pch: use raw_spinlock_t for the register lock pch_irq_type() is registered as the irq_chip .irq_set_type callback and takes chip->spinlock with spin_lock_irqsave(). This callback is reached from __setup_irq() -> __irq_set_trigger() -> chip->irq_set_type() while the caller holds desc->lock, a raw_spinlock_t, with hardirqs disabled. That context is not sleepable, but on PREEMPT_RT a regular spinlock_t is an rtmutex-backed sleeping lock, so acquiring it there is invalid. This was confirmed on a PREEMPT_RT kernel with lockdep (PROVE_RAW_LOCK_NESTING and DEBUG_ATOMIC_SLEEP). A grounded PoC mirrored pch_irq_type()'s locking and drove it through the real genirq carrier irq_set_irq_type() -> __irq_set_trigger() -> chip->irq_set_type(), i.e. the same __irq_set_trigger() edge that __setup_irq() takes for a requested IRQ. With the original spin_lock_irqsave() edge lockdep reported an invalid wait context, immediately followed by: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 95, name: insmod hardirqs last disabled at (3784): _raw_spin_lock_irqsave+0x4f/0x60 rt_spin_lock+0x3a/0x1c0 repro_irq_set_type+0x64/0xa0 [pch_repro] __irq_set_trigger+0x69/0x140 irq_set_irq_type+0x78/0xd0 Switching the mirrored lock to raw_spinlock_t made both splats go away. Convert the register lock to raw_spinlock_t. The same lock also serializes the GPIO direction/value callbacks and the suspend/resume register save/restore, but all of those critical sections only perform MMIO register accesses (ioread32()/iowrite32()) and irq_set_handler_locked(); none of them contain sleepable operations. Keeping this register lock non-sleeping is therefore appropriate for the irqchip callbacks and does not change the GPIO-side locking contract. This is the same class of issue and fix as recently addressed for other GPIO controllers, e.g. commit 286533cb14a3 ("gpio: sch: use raw_spinlock_t in the irq startup path") and commit 90f0109019e6 ("gpio: eic-sprd: use raw_spinlock_t in the irq startup path").

The advisory is available at git.kernel.org. This vulnerability is handled as CVE-2026-74468 since 08/15/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 339550 (Debian dsa-6466 : ata-modules-6.12.101+deb13-armmp-di - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.6.151, 6.12.103, 6.18.44, 7.1.8 or 7.2-rc6 eliminates this vulnerability. Applying the patch 16da33cb36e663b6967112185e11d00ce8ff957c/ff050589a21967883bb55f6dba42568f8367ad4a/466ab0c41d5f54f71cee60619d07c4abd0ffd2cd/c0a4ec89fc26e4b679b04f1002c503cb2529acdc/a02b8950d619123da64f69b70fe1dadef217dfe4 is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Tenable (339550). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.6.150
• 6.12.102
• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.18.16
• 6.18.17
• 6.18.18
• 6.18.19
• 6.18.20
• 6.18.21
• 6.18.22
• 6.18.23
• 6.18.24
• 6.18.25
• 6.18.26
• 6.18.27
• 6.18.28
• 6.18.29
• 6.18.30
• 6.18.31
• 6.18.32
• 6.18.33
• 6.18.34
• 6.18.35
• 6.18.36
• 6.18.37
• 6.18.38
• 6.18.39
• 6.18.40
• 6.18.41
• 6.18.42
• 6.18.43
• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.2-rc1
• 7.2-rc2
• 7.2-rc3
• 7.2-rc4
• 7.2-rc5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

VulDB Vector: 🔒
VulDB Reliability: 🔍

CVSSv3info

VulDB Meta Base Score: 6.5
VulDB Meta Temp Score: 6.2

VulDB Base Score: 6.5
VulDB Temp Score: 6.2
VulDB Vector: 🔒
VulDB Reliability: 🔍

CVSSv2info

AV	AC	Au	C	I	A
💳	💳	💳	💳	💳	💳
💳	💳	💳	💳	💳	💳
💳	💳	💳	💳	💳	💳

Vector	Complexity	Authentication	Confidentiality	Integrity	Availability
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍

Exploitinginfo

Class: Locking
CWE: CWE-667
CAPEC: 🔒
ATT&CK: 🔒

Physical: No
Local: No
Remote: Yes

Availability: 🔒
Status: Not defined

EPSS Score: 🔒
EPSS Percentile: 🔒

Price Prediction: 🔍
Current Price Estimation: 🔒

0-Day	Unlock	Unlock	Unlock	Unlock
Today	Unlock	Unlock	Unlock	Unlock

Nessus ID: 339550
Nessus Name: Debian dsa-6466 : ata-modules-6.12.101+deb13-armmp-di - security update

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Upgrade
Status: 🔍

0-Day Time: 🔒

Upgrade: Kernel 6.6.151/6.12.103/6.18.44/7.1.8/7.2-rc6
Patch: 16da33cb36e663b6967112185e11d00ce8ff957c/ff050589a21967883bb55f6dba42568f8367ad4a/466ab0c41d5f54f71cee60619d07c4abd0ffd2cd/c0a4ec89fc26e4b679b04f1002c503cb2529acdc/a02b8950d619123da64f69b70fe1dadef217dfe4

Timelineinfo

08/15/2026 Advisory disclosed
08/15/2026 +0 days CVE reserved
08/15/2026 +0 days VulDB entry created
08/26/2026 +11 days VulDB entry last update

Sourcesinfo

Vendor: kernel.org

Advisory: git.kernel.org
Status: Confirmed

CVE: CVE-2026-74468 (🔒)
GCVE (CVE): GCVE-0-2026-74468
GCVE (VulDB): GCVE-100-390770

Entryinfo

Created: 08/15/2026 14:55
Updated: 08/26/2026 16:36
Changes: 08/15/2026 14:55 (60), 08/26/2026 16:36 (2)
Complete: 🔍
Cache ID: 216::103

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion

Do you know our Splunk app?

Download it now for free!