Answer in brief
CVE-2026-64241 records a Medium severity (CVSS 5.5) vulnerability in gpio: rockchip: teardown bugs and resource leaks. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=936ee2675eee1faca0dcdfa79165c7990422e0fc <77b6ff33c8f5642f7e7c1ca691857218683264fd || >=936ee2675eee1faca0dcdfa79165c7990422e0fc <cdc603ce3118232712ba443dd8b414d8f25ca467 || >=936ee2675eee1faca0dcdfa79165c7990422e0fc <7f945f7f10f442270518dfd768d230227c495fcf || >=936ee2675eee1faca0dcdfa79165c7990422e0fc <6be81e77e1748665d7ddab9128ff1d35eb75b87d || >=936ee2675eee1faca0dcdfa79165c7990422e0fc <9500077678230e36d22bf16d2b9539c13e59a801 | 77b6ff33c8f5642f7e7c1ca691857218683264fd, cdc603ce3118232712ba443dd8b414d8f25ca467, 7f945f7f10f442270518dfd768d230227c495fcf, 6be81e77e1748665d7ddab9128ff1d35eb75b87d, 9500077678230e36d22bf16d2b9539c13e59a801 |
| Linux/Linuxgeneric | 5.15 | Not reported |
Published upstream
Jul 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 14, 2026
In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and resource leaks in the driver's remove path and error handling: 1. Debounce clock reference leak: The debounce clock (bank->db_clk) is obtained using of_clk_get() which increments the clock's reference count, but clk_put() is never called. Register a devm action to cleanly release it on unbind. Note that of_clk_get(..., 1) remains necessary over devm_clk_get() because the DT binding does not define clock-names, precluding name-based lookup. 2. Unregistered chained IRQ handler: The chained IRQ handler is not disconnected in remove(). If a stray interrupt fires after the driver is removed, the kernel attempts to execute a stale handler, leading to a panic. Fix this by clearing the handler in remove(). 3. IRQ domain leak: The linear IRQ domain and its generic chips are allocated manually during probe but never removed. Remove the IRQ domain during driver teardown to free the associated generic chips and mappings. [Bartosz: don't emit an error message on devres allocation failure]
Quoted source text, attributed separately from HOL analysis.