CVE-2026-92482

What it actually does

Use-after-free occurs when device-managed memory for a gpio_chip is freed by devm while the chip remains registered via the non-managed gpiochip_add_data() path, allowing dangling references after module unbind or rmmod.

Why it matters to the business

Systems running the affected driver as a loadable module risk kernel instability, crashes, or potential code execution when the module is unloaded, increasing operational risk for embedded or modular Linux deployments.

How an attack unfolds

An attacker with local privileges triggers module unload or device unbind on a system using the mediatek pinctrl driver, causing the devm-managed gpio_chip memory to be released while still referenced, resulting in a use-after-free that can be leveraged for memory corruption.

How to fix it

Rebuild or upgrade to a kernel containing the commit that replaces gpiochip_add_data() with devm_gpiochip_add_data() and removes manual gpiochip_remove() error paths; rebuild affected modules if necessary and verify the driver uses the managed registration helper.

How to confirm the fix worked

Inspect the pinctrl-mediatek source for calls to devm_gpiochip_add_data() instead of gpiochip_add_data(); confirm absence of manual gpiochip_remove() in error paths and test module load/unload cycles under memory debugging tools such as KASAN.

Typical attack path

1. Obtain local access or privileges sufficient to load/unload kernel modules
2. Identify and trigger unbind or rmmod of the mediatek pinctrl driver
3. Force the device-managed allocator to release gpio_chip memory while it is still registered
4. Exploit the resulting dangling pointer for memory corruption or control-flow hijack

How to detect it

Review kernel logs for use-after-free reports or KASAN splats referencing gpio_chip structures during module unload; correlate with auditd or kernel module load/unload events and look for unexpected driver unbind activity on systems using mediatek pinctrl.

What your security team should do

• Prioritize kernel updates containing the devm_gpiochip_add_data() change for any systems that may load the driver as a module
• Audit custom or downstream kernels for the same non-managed registration pattern
• Disable unnecessary module unloading in production environments until patched
• Monitor kernel mailing lists for backports to supported LTS branches