CVE-2026-45868

What it actually does

This is a Linux kernel resource-management flaw in the pinctrl-single driver path, specifically in pcs_add_gpio_func(). The vulnerable code calls of_parse_phandle_with_args(), which increments the reference count on a device tree node, but fails to release that reference with of_node_put() after processing. Repeated execution of the affected path can leak device_node references, gradually consuming kernel memory or preventing cleanup of device tree objects. The practical security impact is local denial of service: a local user with sufficient ability to trigger the affected kernel code path may be able to degrade system stability or cause availability loss. There is no indication that the flaw enables privilege escalation, code execution, or data disclosure.

Why it matters to the business

Systems running affected Linux kernel versions may be susceptible to local availability disruption. The most likely operational consequence is kernel memory exhaustion or instability on systems using the affected pinctrl-single/device tree functionality, which can lead to service degradation, crashes, or required reboots. The risk is lower than internet-exposed remote code execution because exploitation requires local access and a relevant kernel/device-tree configuration, but it still matters for shared systems, embedded Linux platforms, appliances, and environments where untrusted local workloads or users can interact with hardware, device overlays, or kernel interfaces.

How an attack unfolds

An attacker first needs local access to a system running an affected Linux kernel and a configuration where the pinctrl-single driver and relevant device tree parsing path can be reached. The attacker then repeatedly triggers the code path that parses GPIO phandles for pinctrl-single functions. Each iteration leaks a reference to a device tree node because the kernel increments the node reference count but does not release it. Over time, repeated triggering can accumulate unreleased kernel references and associated memory pressure. If sustained, this can reduce available kernel memory, interfere with device tree cleanup, or destabilize the host, ultimately causing denial of service through degraded performance, failed allocations, hung services, or system crash. There are no public indications of active exploitation, ransomware use, or mature exploit code based on the provided data.

How to fix it

Upgrade to a Linux kernel version that includes the fix for the pinctrl-single refcount leak in pcs_add_gpio_func(), specifically the change that releases gpiospec.np with of_node_put() after successful parsing and on the devm_kzalloc() error path. No exact fixed package versions were provided, so use vendor advisories for the relevant distribution, appliance, embedded platform, or kernel branch. Where immediate patching is not possible, reduce exposure by limiting local shell access, restricting untrusted users and workloads, disabling unnecessary device tree overlay mechanisms, limiting access to configfs/debugfs/sysfs interfaces that can affect device or overlay state, and avoiding repeated dynamic hardware overlay operations on affected systems. Embedded and appliance vendors should backport the upstream kernel patch into their maintained kernel trees and validate board-specific device tree behavior after patching.

How to confirm the fix worked

Confirm remediation by verifying that the running kernel build contains the upstream fix in the pinctrl-single driver, not merely that source packages have been updated. Validate with the distribution or vendor kernel changelog, package advisory, or source diff showing of_node_put() calls added for gpiospec.np in pcs_add_gpio_func(). On source-based or custom kernels, inspect drivers/pinctrl/pinctrl-single.c and confirm the reference returned by of_parse_phandle_with_args() is released on both normal and allocation-failure paths. After deployment, reboot into the fixed kernel and verify with uname -a, package manager metadata, or fleet kernel inventory. For functional validation, exercise relevant pinctrl/GPIO/device-tree workflows and monitor kernel logs, memory consumption, and device initialization behavior for regressions or persistent memory growth.

Typical attack path

1. Gain local access to a Linux system running an affected kernel.
2. Confirm that the system uses the pinctrl-single driver and device tree GPIO/pinctrl functionality relevant to the vulnerable path.
3. Trigger or reload functionality that causes pcs_add_gpio_func() to parse GPIO phandles repeatedly, such as through applicable device initialization, overlays, or hardware-management workflows available on the target platform.
4. Repeat the trigger enough times to accumulate leaked device_node references.
5. Cause kernel memory pressure or resource exhaustion, leading to service instability, failed kernel allocations, hangs, crashes, or forced reboot.

How to detect it

Detecting prior exploitation is difficult because the flaw is a reference-count leak rather than an action that produces a unique exploit signature. Focus on evidence of repeated triggering of device-tree, GPIO, pinctrl, or overlay activity followed by kernel memory pressure or availability symptoms. Review kernel logs, system journal, audit logs, configfs access logs where available, EDR process telemetry, and uptime/reboot history. Look for repeated device tree overlay creation or removal, repeated pinctrl-single probe or initialization messages, OOM killer activity, kernel allocation failures, unexplained memory growth in kernel/slab usage, hangs, watchdog resets, or crashes. On systems with auditd or EDR, investigate local users or processes that accessed /sys/kernel/config/device-tree/overlays, mounted configfs/debugfs, manipulated hardware overlays, or repeatedly caused device probing. Correlate these actions with kernel warnings, OOM events, service failures, or reboots. Absence of these artifacts does not prove non-exploitation, especially on embedded systems with limited logging.

• pinctrl-single
• pcs_add_gpio_func
• of_parse_phandle_with_args
• /sys/kernel/config/device-tree/overlays
• device-tree/overlays
• OF: overlay
• configfs
• debugfs
• Out of memory
• oom-killer
• Killed process
• page allocation failure
• Kernel panic
• watchdog: BUG: soft lockup
• watchdog: hard LOCKUP

What your security team should do

• Prioritize patching affected Linux kernels on embedded systems, appliances, shared compute hosts, and platforms where local users or workloads may interact with device tree overlays or hardware-management interfaces.
• Inventory systems using the pinctrl-single driver or device-tree-based GPIO/pinctrl configurations; these are the most relevant exposure candidates.
• Apply vendor-provided fixed kernel updates or backport the upstream pinctrl-single refcount fix into custom kernel branches.
• Restrict local access and remove unnecessary permissions to interfaces such as configfs, debugfs, and sysfs paths that may allow device or overlay manipulation.
• Monitor affected systems for unexplained kernel memory growth, repeated device-tree overlay activity, OOM events, allocation failures, or system instability until patched.
• Because EPSS is very low and the issue is not listed in KEV, treat this as a reliability and local DoS patching priority rather than an emergency internet-facing exploitation event, unless the affected systems are multi-tenant or safety/availability critical.