Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-64023

gpio: aggregator: fix a potential use-after-free

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: fix a potential use-after-free On error we free aggr->lookups->dev_id before removing the entry from the lookup table. If a concurrent thread calls gpiod_find() before we remove the entry, it could iterate over the list and call gpiod_match_lookup_table() which unconditionally dereferences dev_id when calling strcmp(). Reverse the order of cleanup.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8 to < ea28b286649b70618e9dd3e895812417a7712a11affected
  • 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8 to < 7ac4183a41ba048af89eddd82fe8be64619d0871affected
  • 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8 to < 30c073cab97afb31901f94de9605177b6b84367eaffected

Linux Linux

Default version status: affected

  • 6.16affected
  • 0 to < 6.16unaffected
  • 6.18.34 to ≤ 6.18.*unaffected
  • 7.0.11 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References