CVE-2026-93274: pinctrl: bcm2835: Don't remove an unregistered GPIO chip

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-24 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devm_pinctrl_register() function fails, bcm2835_pinctrl_probe() calls gpiochip_remove() before gpiochip_add_data() has registered the GPIO chip. This means that upon failure the gpio_chip.gpiodev is NULL resulting in a null pointer dereference inside the gpiochip_remove() function. Remove the unnecessary function call to gpiochip_remove(). No GPIO cleanup is required because the GPIO chip has not yet been registered. Without this change there is potential for a kernel panic upon registration failure

Affected products

Linux kernel: from 5.10.89 before 5.10.270; from 5.15.12 before 5.15.221; from 5.4.175 before 5.5; 5.16 — fixed in 5.10.270, 5.15.221, 5.5, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 5.10.270, 5.15.221, 5.5, 7.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-93274 or the next vulnerability affects your stack