---
id: CVE-2026-98605
title: 'drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

  When the Exynos DSI driver was generalized into samsung-dsim, the TE
  GPIO acquisition was switched from …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e7447128ca4a250374d6721ee98e3e3cf99551a6 <
    77a43e00c57486a5212ef22d4665cafad62a5d4b
  - >-
    Linux >= e7447128ca4a250374d6721ee98e3e3cf99551a6 <
    5759bbef951c39d264ac0f47daa4137d01403aea
  - >-
    Linux >= e7447128ca4a250374d6721ee98e3e3cf99551a6 <
    ebffd70e4877bb7554974cf975a27872f2bb225f
  - >-
    Linux >= e7447128ca4a250374d6721ee98e3e3cf99551a6 <
    9b796251c3cca45a33a5c859c6818c58aa982277
  - >-
    Linux >= e7447128ca4a250374d6721ee98e3e3cf99551a6 <
    ada667890773e033d2f40dc94176e3beb930b516
  - Linux 6.4
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:19:18.294Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98605'
references:
  - url: 'https://git.kernel.org/stable/c/77a43e00c57486a5212ef22d4665cafad62a5d4b'
  - url: 'https://git.kernel.org/stable/c/5759bbef951c39d264ac0f47daa4137d01403aea'
  - url: 'https://git.kernel.org/stable/c/ebffd70e4877bb7554974cf975a27872f2bb225f'
  - url: 'https://git.kernel.org/stable/c/9b796251c3cca45a33a5c859c6818c58aa982277'
  - url: 'https://git.kernel.org/stable/c/ada667890773e033d2f40dc94176e3beb930b516'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.244Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

When the Exynos DSI driver was generalized into samsung-dsim, the TE
GPIO acquisition was switched from gpiod_get_optional() to
devm_gpiod_get_optional() while keeping the matching gpiod_put() calls.
That combination is wrong for a managed descriptor.

However, dropping the puts and keeping the managed get is also wrong:
samsung_dsim_register_te_irq() runs from the DSI host attach callback,
and host detach/reattach can happen without destroying the device that
owns the managed action. A second attach would then request the GPIO
again without having released it.

Switch back to a non-managed gpiod_get_optional() and keep the explicit
gpiod_put() on the request_irq() error path and in
samsung_dsim_unregister_te_irq().

[Luca: remove unnecessary comment]

## Affected

- `Linux >= e7447128ca4a250374d6721ee98e3e3cf99551a6 < 77a43e00c57486a5212ef22d4665cafad62a5d4b`
- `Linux >= e7447128ca4a250374d6721ee98e3e3cf99551a6 < 5759bbef951c39d264ac0f47daa4137d01403aea`
- `Linux >= e7447128ca4a250374d6721ee98e3e3cf99551a6 < ebffd70e4877bb7554974cf975a27872f2bb225f`
- `Linux >= e7447128ca4a250374d6721ee98e3e3cf99551a6 < 9b796251c3cca45a33a5c859c6818c58aa982277`
- `Linux >= e7447128ca4a250374d6721ee98e3e3cf99551a6 < ada667890773e033d2f40dc94176e3beb930b516`
- `Linux 6.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.