CVE-2026-23308: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23308 is a Linux kernel vulnerability in the pinctrl: equilibrium driver that causes excessive warning traces to be logged during driver initialization. The root cause is an incorrect callback function composition in eqbr_irq_mask_ack(), which calls eqbr_irq_mask() (itself invoking gpiochip_disable_irq()) and eqbr_irq_ack(), resulting in a kernel WARNING for every GPIO on load. Affected Linux kernel versions include 6.4–6.6.129, 6.7–6.12.76, 6.13–6.18.16, 6.19–6.19.6, and release candidates 7.0-rc1 and 7.0-rc2. It was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The vulnerability is classified as CWE-779 (Logging of Excessive Data). The eqbr_irq_mask_ack() callback in drivers/pinctrl/equilibrium calls both eqbr_irq_mask() and eqbr_irq_ack() to avoid code duplication; however, eqbr_irq_mask() also invokes the gpiolib function gpiochip_disable_irq(), which performs an internal reference count check that fails during initialization, triggering a kernel WARN_ON for each GPIO. This is a local, low-complexity issue requiring low privileges and no user interaction, exploitable during kernel boot or driver load on systems using the Lantiq/Intel equilibrium pinctrl hardware. The fix restructures eqbr_irq_mask_ack() to implement the mask and ack logic inline without calling the higher-level wrappers, mirroring the approach used in drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c (Red Hat Bugzilla, Kernel Patch).

The primary impact is availability degradation: the kernel log is flooded with WARNING traces for every GPIO during driver initialization, which can obscure legitimate kernel messages and complicate system diagnostics. There is no confidentiality or integrity impact. In a secondary sense, the log noise could be leveraged by a local attacker to mask other malicious kernel-level activities within the system logs (Red Hat CVE).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.018% (0.000180), indicating very low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat CVE).

• Logs: Repeated kernel WARNING messages at boot time referencing gpiochip_disable_irq+0x39/0x50 in drivers/gpio/gpiolib.c:3810, tagged with [W]=WARN and originating from swapper/0 (PID 1) during pinctrl equilibrium driver initialization.
• Logs: Call trace entries showing eqbr_irq_mask_ack → eqbr_irq_mask in the kernel ring buffer (dmesg) for each GPIO present on the system.

Update the Linux kernel to a patched stable version: 6.6.130 or later (for the 6.4–6.6 branch), 6.12.77 or later (for the 6.7–6.12 branch), 6.18.17 or later (for the 6.13–6.18 branch), or 6.19.7 or later (for the 6.19 branch). Patches are available in the Linux kernel stable tree at git.kernel.org. SUSE has released advisories SUSE-SU-2026:2217-1 and SUSE-SU-2026:2238-1, and Debian has addressed this in DSA-6238-1. As a workaround, systems not using Lantiq/Intel equilibrium pinctrl hardware are not affected and require no action (Red Hat CVE, Kernel Patch).