{"api_version":"1","generated_at":"2026-05-08T03:59:43+00:00","cve":"CVE-2026-43087","urls":{"html":"https://cve.report/CVE-2026-43087","api":"https://cve.report/api/cve/CVE-2026-43087.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-43087","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-43087"},"summary":{"title":"pinctrl: mcp23s08: Disable all pin interrupts during probe","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mcp23s08: Disable all pin interrupts during probe\n\nA chip being probed may have the interrupt-on-change feature enabled on\nsome of its pins, for example after a reboot. This can cause the chip to\ngenerate interrupts for pins that don't have a registered nested handler,\nwhich leads to a kernel crash such as below:\n\n[    7.928897] Unable to handle kernel read from unreadable memory at virtual address 00000000000000ac\n[    7.932314] Mem abort info:\n[    7.935081]   ESR = 0x0000000096000004\n[    7.938808]   EC = 0x25: DABT (current EL), IL = 32 bits\n[    7.944094]   SET = 0, FnV = 0\n[    7.947127]   EA = 0, S1PTW = 0\n[    7.950247]   FSC = 0x04: level 0 translation fault\n[    7.955101] Data abort info:\n[    7.957961]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[    7.963421]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[    7.968447]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[    7.973734] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000089b7000\n[    7.980148] [00000000000000ac] pgd=0000000000000000, p4d=0000000000000000\n[    7.986913] Internal error: Oops: 0000000096000004 [#1]  SMP\n[    7.992545] Modules linked in:\n[    8.073678] CPU: 0 UID: 0 PID: 81 Comm: irq/18-4-0025 Not tainted 7.0.0-rc6-gd2b5a1f931c8-dirty #199\n[    8.073689] Hardware name: Khadas VIM3 (DT)\n[    8.073692] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[    8.094639] pc : _raw_spin_lock_irq+0x40/0x80\n[    8.098970] lr : handle_nested_irq+0x2c/0x168\n[    8.098979] sp : ffff800082b2bd20\n[    8.106599] x29: ffff800082b2bd20 x28: ffff800080107920 x27: ffff800080104d88\n[    8.106611] x26: ffff000003298080 x25: 0000000000000001 x24: 000000000000ff00\n[    8.113707] x23: 0000000000000001 x22: 0000000000000000 x21: 000000000000000e\n[    8.120850] x20: 0000000000000000 x19: 00000000000000ac x18: 0000000000000000\n[    8.135046] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\n[    8.135062] x14: ffff800081567ea8 x13: ffffffffffffffff x12: 0000000000000000\n[    8.135070] x11: 00000000000000c0 x10: 0000000000000b60 x9 : ffff800080109e0c\n[    8.135078] x8 : 1fffe0000069dbc1 x7 : 0000000000000001 x6 : ffff0000034ede00\n[    8.135086] x5 : 0000000000000000 x4 : ffff0000034ede08 x3 : 0000000000000001\n[    8.163460] x2 : 0000000000000000 x1 : 0000000000000001 x0 : 00000000000000ac\n[    8.170560] Call trace:\n[    8.180094]  _raw_spin_lock_irq+0x40/0x80 (P)\n[    8.184443]  mcp23s08_irq+0x248/0x358\n[    8.184462]  irq_thread_fn+0x34/0xb8\n[    8.184470]  irq_thread+0x1a4/0x310\n[    8.195093]  kthread+0x13c/0x150\n[    8.198309]  ret_from_fork+0x10/0x20\n[    8.201850] Code: d65f03c0 d2800002 52800023 f9800011 (885ffc01)\n[    8.207931] ---[ end trace 0000000000000000 ]---\n\nThis issue has always been present, but has been latent until commit\n\"f9f4fda15e72\" (\"pinctrl: mcp23s08: init reg_defaults from HW at probe and\nswitch cache type\"), which correctly removed reg_defaults from the regmap\nand as a side effect changed the behavior of the interrupt handler so that\nthe real value of the MCP_GPINTEN register is now being read from the chip\ninstead of using a bogus 0 default value; a non-zero value for this\nregister can trigger the invocation of a nested handler which may not exist\n(yet).\nFix this issue by disabling all pin interrupts during initialization.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-05-06 10:16:21","updated_at":"2026-05-06 13:08:07"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/f8c3258541a0680a4ebc08b05b2bc5fdad3288a9","name":"https://git.kernel.org/stable/c/f8c3258541a0680a4ebc08b05b2bc5fdad3288a9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/db5b8cecbdf479ad13156af750377e5b43853fab","name":"https://git.kernel.org/stable/c/db5b8cecbdf479ad13156af750377e5b43853fab","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-43087","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43087","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f9f4fda15e720686f1b2b436591ab11255e4e85e f8c3258541a0680a4ebc08b05b2bc5fdad3288a9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f9f4fda15e720686f1b2b436591ab11255e4e85e db5b8cecbdf479ad13156af750377e5b43853fab git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.19","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.19 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.19.14 6.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pinctrl/pinctrl-mcp23s08.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"f8c3258541a0680a4ebc08b05b2bc5fdad3288a9","status":"affected","version":"f9f4fda15e720686f1b2b436591ab11255e4e85e","versionType":"git"},{"lessThan":"db5b8cecbdf479ad13156af750377e5b43853fab","status":"affected","version":"f9f4fda15e720686f1b2b436591ab11255e4e85e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pinctrl/pinctrl-mcp23s08.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.19"},{"lessThan":"6.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.19.*","status":"unaffected","version":"6.19.14","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.0","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.19.14","versionStartIncluding":"6.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0","versionStartIncluding":"6.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mcp23s08: Disable all pin interrupts during probe\n\nA chip being probed may have the interrupt-on-change feature enabled on\nsome of its pins, for example after a reboot. This can cause the chip to\ngenerate interrupts for pins that don't have a registered nested handler,\nwhich leads to a kernel crash such as below:\n\n[    7.928897] Unable to handle kernel read from unreadable memory at virtual address 00000000000000ac\n[    7.932314] Mem abort info:\n[    7.935081]   ESR = 0x0000000096000004\n[    7.938808]   EC = 0x25: DABT (current EL), IL = 32 bits\n[    7.944094]   SET = 0, FnV = 0\n[    7.947127]   EA = 0, S1PTW = 0\n[    7.950247]   FSC = 0x04: level 0 translation fault\n[    7.955101] Data abort info:\n[    7.957961]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[    7.963421]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[    7.968447]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[    7.973734] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000089b7000\n[    7.980148] [00000000000000ac] pgd=0000000000000000, p4d=0000000000000000\n[    7.986913] Internal error: Oops: 0000000096000004 [#1]  SMP\n[    7.992545] Modules linked in:\n[    8.073678] CPU: 0 UID: 0 PID: 81 Comm: irq/18-4-0025 Not tainted 7.0.0-rc6-gd2b5a1f931c8-dirty #199\n[    8.073689] Hardware name: Khadas VIM3 (DT)\n[    8.073692] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[    8.094639] pc : _raw_spin_lock_irq+0x40/0x80\n[    8.098970] lr : handle_nested_irq+0x2c/0x168\n[    8.098979] sp : ffff800082b2bd20\n[    8.106599] x29: ffff800082b2bd20 x28: ffff800080107920 x27: ffff800080104d88\n[    8.106611] x26: ffff000003298080 x25: 0000000000000001 x24: 000000000000ff00\n[    8.113707] x23: 0000000000000001 x22: 0000000000000000 x21: 000000000000000e\n[    8.120850] x20: 0000000000000000 x19: 00000000000000ac x18: 0000000000000000\n[    8.135046] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\n[    8.135062] x14: ffff800081567ea8 x13: ffffffffffffffff x12: 0000000000000000\n[    8.135070] x11: 00000000000000c0 x10: 0000000000000b60 x9 : ffff800080109e0c\n[    8.135078] x8 : 1fffe0000069dbc1 x7 : 0000000000000001 x6 : ffff0000034ede00\n[    8.135086] x5 : 0000000000000000 x4 : ffff0000034ede08 x3 : 0000000000000001\n[    8.163460] x2 : 0000000000000000 x1 : 0000000000000001 x0 : 00000000000000ac\n[    8.170560] Call trace:\n[    8.180094]  _raw_spin_lock_irq+0x40/0x80 (P)\n[    8.184443]  mcp23s08_irq+0x248/0x358\n[    8.184462]  irq_thread_fn+0x34/0xb8\n[    8.184470]  irq_thread+0x1a4/0x310\n[    8.195093]  kthread+0x13c/0x150\n[    8.198309]  ret_from_fork+0x10/0x20\n[    8.201850] Code: d65f03c0 d2800002 52800023 f9800011 (885ffc01)\n[    8.207931] ---[ end trace 0000000000000000 ]---\n\nThis issue has always been present, but has been latent until commit\n\"f9f4fda15e72\" (\"pinctrl: mcp23s08: init reg_defaults from HW at probe and\nswitch cache type\"), which correctly removed reg_defaults from the regmap\nand as a side effect changed the behavior of the interrupt handler so that\nthe real value of the MCP_GPINTEN register is now being read from the chip\ninstead of using a bogus 0 default value; a non-zero value for this\nregister can trigger the invocation of a nested handler which may not exist\n(yet).\nFix this issue by disabling all pin interrupts during initialization."}],"providerMetadata":{"dateUpdated":"2026-05-06T07:40:21.303Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/f8c3258541a0680a4ebc08b05b2bc5fdad3288a9"},{"url":"https://git.kernel.org/stable/c/db5b8cecbdf479ad13156af750377e5b43853fab"}],"title":"pinctrl: mcp23s08: Disable all pin interrupts during probe","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-43087","datePublished":"2026-05-06T07:40:21.303Z","dateReserved":"2026-05-01T14:12:55.983Z","dateUpdated":"2026-05-06T07:40:21.303Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-05-06 10:16:21","lastModifiedDate":"2026-05-06 13:08:07","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"43087","Ordinal":"1","Title":"pinctrl: mcp23s08: Disable all pin interrupts during probe","CVE":"CVE-2026-43087","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"43087","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mcp23s08: Disable all pin interrupts during probe\n\nA chip being probed may have the interrupt-on-change feature enabled on\nsome of its pins, for example after a reboot. This can cause the chip to\ngenerate interrupts for pins that don't have a registered nested handler,\nwhich leads to a kernel crash such as below:\n\n[    7.928897] Unable to handle kernel read from unreadable memory at virtual address 00000000000000ac\n[    7.932314] Mem abort info:\n[    7.935081]   ESR = 0x0000000096000004\n[    7.938808]   EC = 0x25: DABT (current EL), IL = 32 bits\n[    7.944094]   SET = 0, FnV = 0\n[    7.947127]   EA = 0, S1PTW = 0\n[    7.950247]   FSC = 0x04: level 0 translation fault\n[    7.955101] Data abort info:\n[    7.957961]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[    7.963421]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[    7.968447]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[    7.973734] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000089b7000\n[    7.980148] [00000000000000ac] pgd=0000000000000000, p4d=0000000000000000\n[    7.986913] Internal error: Oops: 0000000096000004 [#1]  SMP\n[    7.992545] Modules linked in:\n[    8.073678] CPU: 0 UID: 0 PID: 81 Comm: irq/18-4-0025 Not tainted 7.0.0-rc6-gd2b5a1f931c8-dirty #199\n[    8.073689] Hardware name: Khadas VIM3 (DT)\n[    8.073692] pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[    8.094639] pc : _raw_spin_lock_irq+0x40/0x80\n[    8.098970] lr : handle_nested_irq+0x2c/0x168\n[    8.098979] sp : ffff800082b2bd20\n[    8.106599] x29: ffff800082b2bd20 x28: ffff800080107920 x27: ffff800080104d88\n[    8.106611] x26: ffff000003298080 x25: 0000000000000001 x24: 000000000000ff00\n[    8.113707] x23: 0000000000000001 x22: 0000000000000000 x21: 000000000000000e\n[    8.120850] x20: 0000000000000000 x19: 00000000000000ac x18: 0000000000000000\n[    8.135046] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000\n[    8.135062] x14: ffff800081567ea8 x13: ffffffffffffffff x12: 0000000000000000\n[    8.135070] x11: 00000000000000c0 x10: 0000000000000b60 x9 : ffff800080109e0c\n[    8.135078] x8 : 1fffe0000069dbc1 x7 : 0000000000000001 x6 : ffff0000034ede00\n[    8.135086] x5 : 0000000000000000 x4 : ffff0000034ede08 x3 : 0000000000000001\n[    8.163460] x2 : 0000000000000000 x1 : 0000000000000001 x0 : 00000000000000ac\n[    8.170560] Call trace:\n[    8.180094]  _raw_spin_lock_irq+0x40/0x80 (P)\n[    8.184443]  mcp23s08_irq+0x248/0x358\n[    8.184462]  irq_thread_fn+0x34/0xb8\n[    8.184470]  irq_thread+0x1a4/0x310\n[    8.195093]  kthread+0x13c/0x150\n[    8.198309]  ret_from_fork+0x10/0x20\n[    8.201850] Code: d65f03c0 d2800002 52800023 f9800011 (885ffc01)\n[    8.207931] ---[ end trace 0000000000000000 ]---\n\nThis issue has always been present, but has been latent until commit\n\"f9f4fda15e72\" (\"pinctrl: mcp23s08: init reg_defaults from HW at probe and\nswitch cache type\"), which correctly removed reg_defaults from the regmap\nand as a side effect changed the behavior of the interrupt handler so that\nthe real value of the MCP_GPINTEN register is now being read from the chip\ninstead of using a bogus 0 default value; a non-zero value for this\nregister can trigger the invocation of a nested handler which may not exist\n(yet).\nFix this issue by disabling all pin interrupts during initialization.","Type":"Description","Title":"pinctrl: mcp23s08: Disable all pin interrupts during probe"}]}}}