CVE-2026-80648

A flaw was found in the pinctrl (pin controller) driver for SpacemiT systems in the Linux kernel. An incorrect NULL check in the spacemit_pin_set_config() function can lead to a NULL pointer dereference. This occurs when the system attempts to configure a pin that is not present in the SoC's pin table, potentially causing a system crash and resulting in a Denial of Service (DoS).

A NULL pointer dereference flaw in the Linux kernel's SpacemiT K1 pin controller (pinctrl) driver has been rated as Low impact by Red Hat Product Security. The spacemit_pin_set_config() function tests the numeric pin ID instead of the per-pin descriptor returned by spacemit_get_pin(); as a result, attempting to configure a pin that is not present in the SoC's pin table can dereference a NULL pointer and crash the kernel, causing a local denial of service. The same incorrect check also silently drops the PAD configuration write for pin 0 of every pin group, so pin configuration (for example drive-strength or bias settings) may not be applied as expected. Triggering this flaw requires local access with high privileges to control platform pin configuration (for example via device tree changes), and it does not affect confidentiality or integrity. The vulnerable code was introduced together with SpacemiT K1 pinctrl support and is only present in Red Hat Enterprise Linux 10.3 and 10.4; earlier RHEL releases, RHEL 10.0.z and 10.2.z, and the Red Hat In-Vehicle OS streams do not contain the affected code and are therefore not affected. For the affected RHEL 10.3 and 10.4 streams the fix is deferred to a future maintenance update because the flaw is low severity and requires privileged local access to trigger; the residual risk is limited to a local denial of service or incorrect pin configuration on SpacemiT-based systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.