LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23218: gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc()

In the Linux kernel, the following vulnerability has been resolved: gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc() Fix incorrect NULL check in loongson_gpio_init_irqchip(). The function checks chip->parent instead of chip->irq.parents.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel defect in the Loongson 64-bit GPIO driver. The code checks the wrong pointer after a memory allocation, which can leave an allocation failure undetected. The source bundle provides no CVSS score, CWE, confirmed impact, or active exploitation evidence.

Executive priority

Treat this as a platform-specific kernel maintenance item, not an emergency, unless your environment runs Loongson 64-bit Linux systems. Prioritize normal kernel update workflows and vendor confirmation because severity and impact are not provided.

Technical view

In loongson_gpio_init_irqchip(), the vulnerable code checks chip->parent instead of chip->irq.parents after devm_kcalloc(). Based on the described bug, the main concern is incorrect error handling around IRQ parent allocation in the loongson-64bit GPIO path. Impact is not fully stated in the sources.

Likely exposure

Exposure appears limited to Linux systems running affected kernel revisions with the Loongson 64-bit GPIO driver path relevant. The bundled version data indicates Linux 6.18-era affected versions and stable fixes, but the exact affected range should be confirmed from kernel advisories.

Exploitation context

The provided sources do not show active exploitation, public weaponization, or CISA KEV listing. The issue is a kernel driver correctness flaw, but the bundle does not establish attacker reachability, privilege requirements, or reliable security impact.

Researcher notes

The available evidence identifies a wrong NULL check after devm_kcalloc() in loongson_gpio_init_irqchip(). Do not assume remote exploitability or broad Linux exposure from the bundle. Further triage should inspect the upstream commits and downstream backports for affected branches.

Mitigation direction

  • Review kernel vendor guidance for CVE-2026-23218.
  • Update to a kernel containing the referenced stable fixes.
  • Prioritize Loongson 64-bit systems using affected Linux kernels.
  • Track distribution backports rather than relying only on upstream version numbers.

Validation and detection

  • Inventory Linux kernel versions on Loongson 64-bit assets.
  • Check whether the loongson-64bit GPIO driver is present or enabled.
  • Confirm whether vendor packages include the referenced stable commits.
  • Document systems remaining on affected 6.18-era kernels.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23218 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux03c146cb6cd14fdab2d2c7ab1b4e8035b54df8cc, 03c146cb6cd14fdab2d2c7ab1b4e8035b54df8ccunaffected
LinuxLinux6.18, 0, 6.18.10, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.