pinctrl: mediatek: free EINT resources on unbind

Summary

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: free EINT resources on unbind mtk_eint_do_init() creates an IRQ domain, populates it with a mapping for every EINT line and installs a chained handler on the parent interrupt, but none of these are ever released. This was harmless while the drivers were built-in, but now that they can be built as modules and unbound/rmmod'd it leaves behind a dangling IRQ domain, interrupt mappings whose chip data points at freed memory, and a chained handler that keeps firing into that freed data. The plain allocations in mtk_eint_do_init() already use the device-managed devm_*() helpers, so tear the remaining resources down the same way: register a devm action that detaches the chained handler, waits for any in-flight handler to finish, disposes of the per-line mappings and removes the IRQ domain. This mirrors the device-managed lifecycle adopted for the GPIO chip and keeps the whole EINT setup self-cleaning on unbind.

Timeline

1. Sep 17, 2026, 4:09 PM UTCCVE published
2. Oct 19, 2026, 9:03 AM UTCRecord last updated

Affected versions

• Linux Linux

  From e46df235b4e605aa4e7609a27c118a1cccd4ff9a · fixed in 23252bc1cd9a58a039c9b1ae77b22d2b33da48e9; From e46df235b4e605aa4e7609a27c118a1cccd4ff9a · fixed in 903a7cdf63a81d3738594c5bd1b5955f58fda427; From e46df235b4e605aa4e7609a27c118a1cccd4ff9a · fixed in 51552c8c60d3b1fecc062eab2d8cfeaa1cb339dd; From e46df235b4e605aa4e7609a27c118a1cccd4ff9a · fixed in 7f6d898179ca4771ee602bdad4246c3952af83eb; From e46df235b4e605aa4e7609a27c118a1cccd4ff9a · fixed in e06785cba7f86d72abd531058b1a82d6952a7346; From e46df235b4e605aa4e7609a27c118a1cccd4ff9a · fixed in 88292b7103d260e3e606eb3bb2794060a5fde48e

• Linux Linux

  4.18

• KernelLinux

  From 4.18.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.19.0 · fixed in 7.2.6

References 6