CVE-2026-23308 - Vulnerability Details

- pinctrl: equilibrium: fix warning trace on load

Description

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: equilibrium: fix warning trace on load

The callback functions 'eqbr_irq_mask()' and 'eqbr_irq_ack()' are also
called in the callback function 'eqbr_irq_mask_ack()'. This is done to
avoid source code duplication. The problem, is that in the function
'eqbr_irq_mask()' also calles the gpiolib function 'gpiochip_disable_irq()'

This generates the following warning trace in the log for every gpio on
load.

[ 6.088111] ------------[ cut here ]------------
[ 6.092440] WARNING: CPU: 3 PID: 1 at drivers/gpio/gpiolib.c:3810 gpiochip_disable_irq+0x39/0x50
[ 6.097847] Modules linked in:
[ 6.097847] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.12.59+ #0
[ 6.097847] Tainted: [W]=WARN
[ 6.097847] RIP: 0010:gpiochip_disable_irq+0x39/0x50
[ 6.097847] Code: 39 c6 48 19 c0 21 c6 48 c1 e6 05 48 03 b2 38 03 00 00 48 81 fe 00 f0 ff ff 77 11 48 8b 46 08 f6 c4 02 74 06 f0 80 66 09 fb c3 <0f> 0b 90 0f 1f 40 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40
[ 6.097847] RSP: 0000:ffffc9000000b830 EFLAGS: 00010046
[ 6.097847] RAX: 0000000000000045 RBX: ffff888001be02a0 RCX: 0000000000000008
[ 6.097847] RDX: ffff888001be9000 RSI: ffff888001b2dd00 RDI: ffff888001be02a0
[ 6.097847] RBP: ffffc9000000b860 R08: 0000000000000000 R09: 0000000000000000
[ 6.097847] R10: 0000000000000001 R11: ffff888001b2a154 R12: ffff888001be0514
[ 6.097847] R13: ffff888001be02a0 R14: 0000000000000008 R15: 0000000000000000
[ 6.097847] FS: 0000000000000000(0000) GS:ffff888041d80000(0000) knlGS:0000000000000000
[ 6.097847] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 6.097847] CR2: 0000000000000000 CR3: 0000000003030000 CR4: 00000000001026b0
[ 6.097847] Call Trace:
[ 6.097847] <TASK>
[ 6.097847] ? eqbr_irq_mask+0x63/0x70
[ 6.097847] ? no_action+0x10/0x10
[ 6.097847] eqbr_irq_mask_ack+0x11/0x60

In an other driver (drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c) the
interrupt is not disabled here.

To fix this, do not call the 'eqbr_irq_mask()' and 'eqbr_irq_ack()'
function. Implement instead this directly without disabling the interrupts.

Published: 2026-03-25

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The equilibrium pinctrl driver in the Linux kernel invokes gpiochip_disable_irq during interrupt masking functions, causing a warning trace to appear for every GPIO device that loads. The code path does not lead to privilege escalation, data leakage, or denial of service; the effect is a repetitive warning message in the kernel logs.

Affected Systems

All Linux kernel installations that include the unmodified equilibrium pinctrl driver are affected, as illustrated by the 6.12.59+ kernel build in the sample log. Any distribution that has not applied the upstream patch will generate the warning trace during system boot or module load.

Risk and Exploitability

The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating an extremely low likelihood of exploitation. Because the issue manifests only as extraneous log output, the overall risk is considered minimal and there is no direct impact on confidentiality, integrity, or availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`52066a53bd116a2f41d04d99b5095c02ad8cf953`	affected	< 896449ad9053a42c6c710aeae6175170176cabd0
`52066a53bd116a2f41d04d99b5095c02ad8cf953`	affected	< af3b0ec98dc1133521b612f8009fdd36b612aabe
`52066a53bd116a2f41d04d99b5095c02ad8cf953`	affected	< 53eba152810ef0fff8567b13ea0f62d48e62df6b
`52066a53bd116a2f41d04d99b5095c02ad8cf953`	affected	< ec54546e8d8a50a9824c139a127a8459d1b0b1bb
`52066a53bd116a2f41d04d99b5095c02ad8cf953`	affected	< 3e00b1b332e54ba50cca6691f628b9c06574024f

Linux

affected

Version	Status	Constraints
`6.4`	affected	—
`0`	unaffected	< 6.4
`6.6.130`	unaffected	≤ 6.6.*
`6.12.77`	unaffected	≤ 6.12.*
`6.18.17`	unaffected	≤ 6.18.*
`6.19.7`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[52066a53bd116a2f41d04d99b5095c02ad8cf953,896449ad9053a42c6c710aeae6175170176cabd0)`	affected	code_commit	—
`[52066a53bd116a2f41d04d99b5095c02ad8cf953,af3b0ec98dc1133521b612f8009fdd36b612aabe)`	affected	code_commit	—
`[52066a53bd116a2f41d04d99b5095c02ad8cf953,53eba152810ef0fff8567b13ea0f62d48e62df6b)`	affected	code_commit	—
`[52066a53bd116a2f41d04d99b5095c02ad8cf953,ec54546e8d8a50a9824c139a127a8459d1b0b1bb)`	affected	code_commit	—
`[52066a53bd116a2f41d04d99b5095c02ad8cf953,3e00b1b332e54ba50cca6691f628b9c06574024f)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.4`	affected	generic	—
`[0,6.4)`	unaffected	generic	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.77,6.13.0)`	unaffected	semver	—
`[6.18.17,6.19.0)`	unaffected	semver	—
`[6.19.7,6.20.0)`	unaffected	semver	—
`[7.0-rc3,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the kernel to a version that contains the patch for the equilibrium pinctrl driver.
If a kernel upgrade is not immediately possible, configure the kernel log level or redirect the log output to reduce noise from the redundant warning trace.
Continuously monitor kernel logs for unexpected increases in warning messages to ensure the issue has been resolved.

Generated by OpenCVE AI on March 26, 2026 at 14:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6238-1	linux security update

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00026.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3e00b1b332e54ba50cca6691f628b9c06574024f
https://git.kernel.org/stable/c/53eba152810ef0fff8567b13ea0f62d48e62df6b
https://git.kernel.org/stable/c/896449ad9053a42c6c710aeae6175170176cabd0
https://git.kernel.org/stable/c/af3b0ec98dc1133521b612f8009fdd36b612aabe
https://git.kernel.org/stable/c/ec54546e8d8a50a9824c139a127a8459d1b0b1bb
https://lore.kernel.org/linux-cve-announce/2026032528-CVE-2026-23308-1e72@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23308
https://www.cve.org/CVERecord?id=CVE-2026-23308

History

Thu, 26 Mar 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-390 CWE-400

Thu, 26 Mar 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-779
References		https://lore.kernel.org/linux-cve-announce/2026032528-CVE-2026-23308-1e72@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23308 https://www.cve.org/CVERecord?id=CVE-2026-23308

Wed, 25 Mar 2026 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-390 CWE-400

Wed, 25 Mar 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: pinctrl: equilibrium: fix warning trace on load The callback functions 'eqbr_irq_mask()' and 'eqbr_irq_ack()' are also called in the callback function 'eqbr_irq_mask_ack()'. This is done to avoid source code duplication. The problem, is that in the function 'eqbr_irq_mask()' also calles the gpiolib function 'gpiochip_disable_irq()' This generates the following warning trace in the log for every gpio on load. [ 6.088111] ------------[ cut here ]------------ [ 6.092440] WARNING: CPU: 3 PID: 1 at drivers/gpio/gpiolib.c:3810 gpiochip_disable_irq+0x39/0x50 [ 6.097847] Modules linked in: [ 6.097847] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Tainted: G W 6.12.59+ #0 [ 6.097847] Tainted: [W]=WARN [ 6.097847] RIP: 0010:gpiochip_disable_irq+0x39/0x50 [ 6.097847] Code: 39 c6 48 19 c0 21 c6 48 c1 e6 05 48 03 b2 38 03 00 00 48 81 fe 00 f0 ff ff 77 11 48 8b 46 08 f6 c4 02 74 06 f0 80 66 09 fb c3 <0f> 0b 90 0f 1f 40 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 [ 6.097847] RSP: 0000:ffffc9000000b830 EFLAGS: 00010046 [ 6.097847] RAX: 0000000000000045 RBX: ffff888001be02a0 RCX: 0000000000000008 [ 6.097847] RDX: ffff888001be9000 RSI: ffff888001b2dd00 RDI: ffff888001be02a0 [ 6.097847] RBP: ffffc9000000b860 R08: 0000000000000000 R09: 0000000000000000 [ 6.097847] R10: 0000000000000001 R11: ffff888001b2a154 R12: ffff888001be0514 [ 6.097847] R13: ffff888001be02a0 R14: 0000000000000008 R15: 0000000000000000 [ 6.097847] FS: 0000000000000000(0000) GS:ffff888041d80000(0000) knlGS:0000000000000000 [ 6.097847] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.097847] CR2: 0000000000000000 CR3: 0000000003030000 CR4: 00000000001026b0 [ 6.097847] Call Trace: [ 6.097847] <TASK> [ 6.097847] ? eqbr_irq_mask+0x63/0x70 [ 6.097847] ? no_action+0x10/0x10 [ 6.097847] eqbr_irq_mask_ack+0x11/0x60 In an other driver (drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c) the interrupt is not disabled here. To fix this, do not call the 'eqbr_irq_mask()' and 'eqbr_irq_ack()' function. Implement instead this directly without disabling the interrupts.
Title		pinctrl: equilibrium: fix warning trace on load
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3e00b1b332e54ba50cca6691f628b9c06574024f https://git.kernel.org/stable/c/53eba152810ef0fff8567b13ea0f62d48e62df6b https://git.kernel.org/stable/c/896449ad9053a42c6c710aeae6175170176cabd0 https://git.kernel.org/stable/c/af3b0ec98dc1133521b612f8009fdd36b612aabe https://git.kernel.org/stable/c/ec54546e8d8a50a9824c139a127a8459d1b0b1bb

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-03-25T10:27:03.536Z

Updated: 2026-05-11T22:04:22.327Z

Reserved: 2026-01-13T15:37:45.994Z

Link: CVE-2026-23308

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-03-25T11:16:26.823

Modified: 2026-03-25T15:41:33.977

Link: CVE-2026-23308

Redhat

Severity :

Publid Date: 2026-03-25T00:00:00Z

Links: CVE-2026-23308 - Bugzilla

OpenCVE Enrichment

Updated: 2026-03-27T09:49:59Z

Weaknesses

CWE-779

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object