CVE-2026-80648

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: spacemit: fix NULL check in spacemit_pin_set_config

spacemit_pin_set_config() looks up the per-pin descriptor with

spacemit_get_pin() then checks the wrong variable for failure:

const struct spacemit_pin *spin = spacemit_get_pin(pctrl, pin);

...

if (!pin)

return -EINVAL;

reg = spacemit_pin_to_reg(pctrl, spin->pin);

pin is an unsigned int pin id, where 0 (GPIO_0 / gmac0_rxdv on K3) is a

valid pin, so rejecting it here drops the PAD config write for the first

pin of every group. On K3 Pico-ITX the GMAC RGMII group lists pin 0 as

its first entry, so its drive-strength / bias configuration was silently

ignored.

The intended guard is against spacemit_get_pin() returning NULL when the

pin id isn't in the SoC's pin table. Check spin instead, which both

restores PAD setup for pin 0 and prevents a NULL deref on spin->pin.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References