Cloudanix VulnDB

CVE-2026-23308

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small coding mistake in a Linux hardware driver produces a flood of warning messages every time the computer starts, making it harder to spot real problems.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Trivial
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Incorrect nesting causes eqbr_irq_mask() to invoke gpiochip_disable_irq() when called from eqbr_irq_mask_ack(), producing a kernel warning trace for every GPIO on driver load.

Why it matters to the business

Boot logs fill with repetitive warnings that can hide genuine problems and signal faulty IRQ handling in the GPIO subsystem on affected kernels, reducing operational visibility.

How an attack unfolds

No remote or privilege-escalation path exists; the only observable effect is local kernel log spam when the pinctrl-equilibrium driver initializes, with no data exposure or code execution.

How to fix it

Apply the upstream fix that rewrites eqbr_irq_mask_ack to perform masking and acknowledgment inline without invoking the separate mask/ack helpers or gpiochip_disable_irq.

How to confirm the fix worked

Boot with the patched driver and confirm the absence of the gpiochip_disable_irq+0x39 warning and eqbr_irq_mask_ack call trace in kernel logs.

Typical attack path

  1. Obtain local shell on a system using the equilibrium pinctrl driver
  2. Trigger driver load or system boot
  3. Observe repeated gpiochip_disable_irq warnings in dmesg

How to detect it

Search kernel logs and dmesg for the exact WARNING line referencing gpiochip_disable_irq+0x39 and the eqbr_irq_mask_ack call stack on systems running the affected driver.

  • WARNING: CPU:.* at drivers/gpio/gpiolib.c:3810 gpiochip_disable_irq+0x39/0x50
  • eqbr_irq_mask_ack+0x11/0x60
  • eqbr_irq_mask+0x63/0x70

What your security team should do

  • Prioritize kernel updates containing the pinctrl-equilibrium fix once released
  • Suppress or rate-limit identical warnings in centralized logging until patched
  • Audit other pinctrl drivers for similar mask/ack nesting patterns

The record

In the Linux kernel, the following vulnerability has been resolved: pinctrl: equilibrium: fix warning trace on load The callback functions 'eqbr_irq_mask()' and 'eqbr_irq_ack()' are also called in the callback function 'eqbr_irq_mask_ack()'. This is done to avoid source code duplication. The problem, is that in the function 'eqbr_irq_mask()' also calles the gpiolib function 'gpiochip_disable_irq()' This generates the following warning trace in the log for every gpio on load. [ 6.088111] ------------[ cut here ]------------ [ 6.092440] WARNING: CPU: 3 PID: 1 at drivers/gpio/gpiolib.c:3810 gpiochip_disable_irq+0x39/0x50 [ 6.097847] Modules linked in: [ 6.097847] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.12.59+ #0 [ 6.097847] Tainted: [W]=WARN [ 6.097847] RIP: 0010:gpiochip_disable_irq+0x39/0x50 [ 6.097847] Code: 39 c6 48 19 c0 21 c6 48 c1 e6 05 48 03 b2 38 03 00 00 48 81 fe 00 f0 ff ff 77 11 48 8b 46 08 f6 c4 02 74 06 f0 80 66 09 fb c3 <0f> 0b 90 0f 1f 40 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 [ 6.097847] RSP: 0000:ffffc9000000b830 EFLAGS: 00010046 [ 6.097847] RAX: 0000000000000045 RBX: ffff888001be02a0 RCX: 0000000000000008 [ 6.097847] RDX: ffff888001be9000 RSI: ffff888001b2dd00 RDI: ffff888001be02a0 [ 6.097847] RBP: ffffc9000000b860 R08: 0000000000000000 R09: 0000000000000000 [ 6.097847] R10: 0000000000000001 R11: ffff888001b2a154 R12: ffff888001be0514 [ 6.097847] R13: ffff888001be02a0 R14: 0000000000000008 R15: 0000000000000000 [ 6.097847] FS: 0000000000000000(0000) GS:ffff888041d80000(0000) knlGS:0000000000000000 [ 6.097847] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.097847] CR2: 0000000000000000 CR3: 0000000003030000 CR4: 00000000001026b0 [ 6.097847] Call Trace: [ 6.097847] <TASK> [ 6.097847] ? eqbr_irq_mask+0x63/0x70 [ 6.097847] ? no_action+0x10/0x10 [ 6.097847] eqbr_irq_mask_ack+0x11/0x60 In an other driver (drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c) the interrupt is not disabled here. To fix this, do not call the 'eqbr_irq_mask()' and 'eqbr_irq_ack()' function. Implement instead this directly without disabling the interrupts.

Affected packages

Ecosystem Package Introduced Fixed