CVE-2026-92482

pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip

The gpio_chip is allocated with device-managed memory but registered with the non-managed gpiochip_add_data(). This was harmless while the drivers were built-in, but once they can be built as modules and unbound/rmmod'd, devm frees the gpio_chip's memory while it is still registered, causing a use-after-free.

Register it with devm_gpiochip_add_data() so it shares the same device-managed lifecycle, which also lets the manual gpiochip_remove() error paths go away.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a6df410d420aa4ff316797d352f69e7ebae5ff98 to before 13a25cb4f0f0863afded5e915cb3bceede221426Affected a6df410d420aa4ff316797d352f69e7ebae5ff98 to before dc6e5d802c88468290fee8826dd3a54cf58da25aAffected a6df410d420aa4ff316797d352f69e7ebae5ff98 to before 2490528a90a26f408ec3e95f865bad35454f9ff3Affected a6df410d420aa4ff316797d352f69e7ebae5ff98 to before 01b5fcdc30c0ab35af960b60508eae1f7f7d32fdAffected a6df410d420aa4ff316797d352f69e7ebae5ff98 to before b8fa1098ee9f627d38bdf7c0ef6c1a6058a4165bAffected a6df410d420aa4ff316797d352f69e7ebae5ff98 to before 9c650317ba553d297f3fc5f0ae40ec53d86f9dabAffected
LinuxLinux	4.1Affected before 4.1Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

a6df410d420aa4ff316797d352f69e7ebae5ff98 to before 13a25cb4f0f0863afded5e915cb3bceede221426Affected
a6df410d420aa4ff316797d352f69e7ebae5ff98 to before dc6e5d802c88468290fee8826dd3a54cf58da25aAffected
a6df410d420aa4ff316797d352f69e7ebae5ff98 to before 2490528a90a26f408ec3e95f865bad35454f9ff3Affected
a6df410d420aa4ff316797d352f69e7ebae5ff98 to before 01b5fcdc30c0ab35af960b60508eae1f7f7d32fdAffected
a6df410d420aa4ff316797d352f69e7ebae5ff98 to before b8fa1098ee9f627d38bdf7c0ef6c1a6058a4165bAffected
a6df410d420aa4ff316797d352f69e7ebae5ff98 to before 9c650317ba553d297f3fc5f0ae40ec53d86f9dabAffected

LinuxLinux

4.1Affected
before 4.1Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.