Description
In the Linux kernel, the following vulnerability has been resolved:

pinctrl: spacemit: fix NULL check in spacemit_pin_set_config

spacemit_pin_set_config() looks up the per-pin descriptor with
spacemit_get_pin() then checks the wrong variable for failure:

const struct spacemit_pin *spin = spacemit_get_pin(pctrl, pin);
...
if (!pin)
return -EINVAL;

reg = spacemit_pin_to_reg(pctrl, spin->pin);

pin is an unsigned int pin id, where 0 (GPIO_0 / gmac0_rxdv on K3) is a
valid pin, so rejecting it here drops the PAD config write for the first
pin of every group. On K3 Pico-ITX the GMAC RGMII group lists pin 0 as
its first entry, so its drive-strength / bias configuration was silently
ignored.

The intended guard is against spacemit_get_pin() returning NULL when the
pin id isn't in the SoC's pin table. Check spin instead, which both
restores PAD setup for pin 0 and prevents a NULL deref on spin->pin.
Published: 2026-08-28
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel pinctrl driver for spacemit contains an incorrect NULL check that permits a NULL pointer dereference and causes the PAD configuration for pin 0 to be skipped. This flaw can trigger a kernel fault during configuration or silently ignore essential pin settings, leading to system instability or malfunction. The weakness is classified as a NULL pointer dereference (CWE‑476).

Affected Systems

The vulnerability resides in the Linux kernel’s spacemit pinctrl driver and affects all kernel versions that include this driver before the patch was applied. The fix was introduced in kernel commits 09c816e5c4d3a8d6d6e4b7537433e5e98505d934 and 7a551951ebeb5b3f05bdb04a73d4593869c984c4. Consequently, any Linux installation running a pre‑patch kernel that utilizes the spacemit driver is susceptible.

Risk and Exploitability

No CVSS score, EPSS score, or KEV listing is available, indicating that publicly documented exploitation is not known. The flaw likely requires local access to the kernel space to trigger the misconfiguration or crash, making it a low‑probability attack. Nonetheless, the potential for a kernel panic or subtle device misbehavior warrants prompt remediation.

Generated by OpenCVE AI on August 28, 2026 at 12:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that contains the spacemit pinctrl patch
  • Verify that the pinctrl‑spacemit driver is compiled and loaded in the updated kernel
  • If an update is not immediately possible, avoid using pin 0 in critical configurations or replace the device until the kernel can be patched

Generated by OpenCVE AI on August 28, 2026 at 12:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Fri, 28 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: pinctrl: spacemit: fix NULL check in spacemit_pin_set_config spacemit_pin_set_config() looks up the per-pin descriptor with spacemit_get_pin() then checks the wrong variable for failure: const struct spacemit_pin *spin = spacemit_get_pin(pctrl, pin); ... if (!pin) return -EINVAL; reg = spacemit_pin_to_reg(pctrl, spin->pin); pin is an unsigned int pin id, where 0 (GPIO_0 / gmac0_rxdv on K3) is a valid pin, so rejecting it here drops the PAD config write for the first pin of every group. On K3 Pico-ITX the GMAC RGMII group lists pin 0 as its first entry, so its drive-strength / bias configuration was silently ignored. The intended guard is against spacemit_get_pin() returning NULL when the pin id isn't in the SoC's pin table. Check spin instead, which both restores PAD setup for pin 0 and prevents a NULL deref on spin->pin.
Title pinctrl: spacemit: fix NULL check in spacemit_pin_set_config
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-28T06:48:57.479Z

Reserved: 2026-08-26T14:34:25.779Z

Link: CVE-2026-80648

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T08:16:49.800

Modified: 2026-08-28T08:16:49.800

Link: CVE-2026-80648

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T13:30:06Z

Weaknesses