CVE-2026-72063
kernel: gpio: tegra: do not call pinctrl for GPIO direction
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · August 15, 2026
Updated · October 30, 2026
Description
A flaw was found in the Linux kernel's Tegra General Purpose Input/Output (GPIO) driver. Redundant calls within the GPIO direction functions can cause the system to attempt to sleep while holding a spinlock. This can be triggered by shared GPIO users, potentially leading to a system hang or unresponsiveness, resulting in a Denial of Service (DoS).
Statement
Red Hat Product Security rates this vulnerability as having a Low severity impact because exploitation requires local access and is strictly limited to systems running on specialized NVIDIA Tegra hardware platforms. The flaw involves improper synchronization during pin direction reconfiguration, which may induce an invalid sleep in an atomic context and trigger a kernel hang. Typical enterprise deployments on standard server hardware do not utilize or initialize this SoC controller, significantly narrowing real-world exposure.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-663 · Use of a Non-reentrant Function in a Concurrent Context