Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: pinctrl: meson: amlogic-a4: fix deadlock issue Accessing the pinconf-pins sysfs… (CVE-2026-64521)
Affects linux-hwe-edgeSource GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| linux-hwe-edge | Affected
| Fixed in– |
AI-suggested
An official fix is available and included in Ubuntu security updates. Users should update their systems to the patched kernel versions listed in the Ubuntu advisories and reboot to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigation actions are necessary beyond applying the official updates.
Description
A deadlock vulnerability in the Linux kernel's pinctrl subsystem for the meson amlogic-a4 platform was fixed. The issue occurred when accessing the pinconf-pins sysfs node, where a mutex was acquired twice leading to a deadlock. This was resolved by changing the code to avoid re-acquiring the mutex. The vulnerability affects multiple versions of the linux-hwe-edge kernel prior to specific 7.0.0 series builds. A patch is available and included in official Ubuntu kernel updates.
Impact
The vulnerability could cause a deadlock when accessing the pinconf-pins sysfs node, potentially leading to system hangs or unresponsiveness. There is no indication of privilege escalation or code execution impact. The issue affects system stability and reliability on affected kernel versions.
Summary
The Linux kernel's pinctrl subsystem for the meson amlogic-a4 platform had a deadlock vulnerability (CVE-2026-64521) caused by pinconf_pins_show() holding pctldev->mutex while the platform driver calls pinctrl_find_gpio_range_from_pin(), which attempts to acquire the same mutex again, resulting in a deadlock. The fix replaces the call with pinctrl_find_gpio_range_from_pin_nolock() to avoid the double mutex acquisition. This issue affects multiple linux-hwe-edge kernel versions prior to 7.0.0-28.28 and related builds. The vulnerability was addressed in official Ubuntu kernel updates as part of a broader security update.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64521 (opens in a new tab)
- git.kernel.org/stable/c/744ac926c0e55267a10b49b5b72582afef4ad49f (opens in a new tab)
- git.kernel.org/stable/c/e72ce029810390eb987a036fb2c8a5da9a23b685 (opens in a new tab)
- git.kernel.org/stable/c/e917713f013423069782ff554935c7a5d4266783 (opens in a new tab)
- ubuntu.com/security/CVE-2026-64521 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2026-64521 (opens in a new tab)
- git.kernel.org/linus/e72ce029810390eb987a036fb2c8a5da9a23b685 (opens in a new tab)
- ubuntu.com/security/notices/USN-8618-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8663-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8664-1 (opens in a new tab)
- ubuntu.com/security/notices/USN-8728-1 (opens in a new tab)