The Rockchip GPIO driver in the Linux kernel contains several teardown bugs that cause resource leaks and stale interrupt handlers. A debounce clock reference obtained during probe is not released, an unregistered chained IRQ handler remains on remove, and an IRQ domain created for the driver is never destroyed. These defects can lead the kernel to reference freed memory or execute a stale handler after the driver is unloaded, resulting in a panic and a full system reboot.

All Linux kernel releases that include the legacy Rockchip GPIO driver, including the 7.1 release candidates and older stable kernels, are affected until the patch that cleans up the clock reference, clears the chained IRQ, and removes the IRQ domain during driver teardown is applied.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require local or privileged access to cause the driver to be unloaded or reloaded while pending interrupts could be delivered, which could trigger a kernel panic. Even without a known active exploit, the potential for a full system crash makes this a significant risk for environments running the affected Rockchip hardware.