7.8

CVE-2026-64023

gpio: aggregator: fix a potential use-after-free

In the Linux kernel, the following vulnerability has been resolved:

gpio: aggregator: fix a potential use-after-free

On error we free aggr->lookups->dev_id before removing the entry from
the lookup table. If a concurrent thread calls gpiod_find() before we
remove the entry, it could iterate over the list and call
gpiod_match_lookup_table() which unconditionally dereferences dev_id
when calling strcmp(). Reverse the order of cleanup.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8
Version < ea28b286649b70618e9dd3e895812417a7712a11
Status affected
Version 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8
Version < 7ac4183a41ba048af89eddd82fe8be64619d0871
Status affected
Version 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8
Version < 30c073cab97afb31901f94de9605177b6b84367e
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.16
Status affected
Version 0
Version < 6.16
Status unaffected
Version <= 6.18.*
Version 6.18.34
Status unaffected
Version <= 7.0.*
Version 7.0.11
Status unaffected
Version <= *
Version 7.1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.025
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/ea28b286649b70618e9dd3e895812417a7712a11
https://git.kernel.org/stable/c/7ac4183a41ba048af89eddd82fe8be64619d0871
https://git.kernel.org/stable/c/30c073cab97afb31901f94de9605177b6b84367e