CVE-2026-98528 gpio: cdev: fix kernel stack leak to user-space in error path
LowCVSS 3.3
EPSS 0.21%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In the Linux kernel, the following vulnerability has been resolved:
gpio: cdev: fix kernel stack leak to user-space in error path
If we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we
return immediately before zeroing the info struct we'll end up passing
to the user-space later in lineinfo_get_v1(). This may leak the kernel
stack contents. Make gpio_desc_to_lineinfo() return int so that the
-ENODEV returned on failure to acquire the guard can be propagated to
the callers.
While not strictly necessary: move the memset() before trying to acquire
the SRCU read lock too for good measure.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/kernel(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| Linux kernel | >= d83cee3d2bb131c7fca7e19f1e33dc7530fd7083, < 8460ee5216ab9a38263b01dca4b0a27e083f70f3 | 8460ee5216ab9a38263b01dca4b0a27e083f70f3 |
| Linux kernel | >= d83cee3d2bb131c7fca7e19f1e33dc7530fd7083, < cf3d043582e106a0e57002bec8a6de8929ba3e1c | cf3d043582e106a0e57002bec8a6de8929ba3e1c |
| Linux kernel | >= d83cee3d2bb131c7fca7e19f1e33dc7530fd7083, < 60a466f231905cd96ae6f0f3c44a710c97873dac | 60a466f231905cd96ae6f0f3c44a710c97873dac |
| Linux kernel | >= d83cee3d2bb131c7fca7e19f1e33dc7530fd7083, < 1feb5d39b05afd902ed9fc902ec5b15be03a4bdb | 1feb5d39b05afd902ed9fc902ec5b15be03a4bdb |
| Linux kernel | = 6.9 | No fix listed |
| Linux kernel | < 6.12.112 | 6.12.112 |
| Linux kernel | < 6.18.55 | 6.18.55 |
| Linux kernel | < 7.2.9 | 7.2.9 |
| Linux kernel | < 7.3 | 7.3 |
| debian/linux(Debian:13) | < 6.12.113-1 | 6.12.113-1 |
| debian/linux(Debian:13) | = 6.12.100-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.101-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.105-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.107-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.111-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.38-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.41-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.43-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.43-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.48-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.57-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.57-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.63-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.63-1~bpo12+1 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:13) | = 6.12.69-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.69-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.73-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.73-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.74-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.74-2 | No fix listed |
| debian/linux(Debian:13) | = 6.12.74-2~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.85-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.85-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.86-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.86-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.88-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.88-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.90-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.90-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.90-2 | No fix listed |
| debian/linux(Debian:13) | = 6.12.90-2~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.94-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.94-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.95-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.95-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.96-1 | No fix listed |
| debian/linux(Debian:14) | < 7.2.9-1 | 7.2.9-1 |
| debian/linux(Debian:14) | = 6.12.100-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.101-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.105-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.107-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.111-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.113-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.38-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.41-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.43-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.43-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.48-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.57-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.57-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.63-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.63-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.69-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.69-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.73-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.73-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-2 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-2~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.85-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.85-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.86-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.86-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.88-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.88-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-2 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-2~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.94-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.94-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.95-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.95-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.96-1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.10-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.11-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.8-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.9-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13~rc6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.11-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-2 | No fix listed |
| debian/linux(Debian:14) | = 6.16.3-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.3-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.5-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.6-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.7-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.8-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.9-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.11-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.13-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.13-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.6-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.7-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.7-2 | No fix listed |
| debian/linux(Debian:14) | = 6.17.8-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.8-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.9-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.12-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.13-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.14-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.15-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.15-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.3-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.5-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.5-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.8-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.9-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.9-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.18~rc4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.18~rc4-1~exp2 | No fix listed |
| debian/linux(Debian:14) | = 6.18~rc5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.18~rc6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.18~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.10-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.11-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.11-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.13-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.13-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.14-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.14-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.6-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.6-2 | No fix listed |
| debian/linux(Debian:14) | = 6.19.6-2~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.8-1 | No fix listed |
| debian/linux(Debian:14) | = 6.19.8-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.19~rc4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19~rc5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19~rc6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.19~rc8-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.0-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.10-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.10-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.12-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.12-2 | No fix listed |
| debian/linux(Debian:14) | = 7.0.12-2~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.13-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.13-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.14-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.3-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.4-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.4-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.7-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.7-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.9-1 | No fix listed |
| debian/linux(Debian:14) | = 7.0.9-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.10-1 | No fix listed |
| debian/linux(Debian:14) | = 7.1.12-1 | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Red Hat CVE page vendor-advisory
- Red Hat Bugzilla 2555004 issue-tracking
- www.cve.org
- nvd.nist.gov
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- Debian Security Tracker CVE-2026-98528 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-8959-1 vendor-advisory
- USN-8960-1 vendor-advisory
- Release Notes vendor-advisory
- USN-9020-1 vendor-advisory
- USN-9019-1 vendor-advisory
- USN-9021-1 vendor-advisory