Executive brief
A vulnerability in the Linux kernel's GPIO management system can cause hardware drivers to malfunction or fail to load. This issue specifically affects how the system identifies hardware pins (GPIOs) on computers using ACPI configuration. An exploit could lead to system instability or allow a local user to interfere with hardware operations, potentially impacting the availability and integrity of the system.
Technical details
An uninitialized variable vulnerability exists in the Linux kernel's gpiolib ACPI implementation. The 'acpi_gpio_info' structure is passed to '__acpi_find_gpio()' without initialization, leading to the use of garbage data in 'info->quirks' during the 'acpi_populate_gpio_lookup' process. This can cause driver probe failures, such as in the 'i2c_hid_acpi' driver, or unpredictable behavior when handling GPIO pins. The vulnerability is reachable via local attack vectors and was introduced in a previous commit intended to improve ACPI GPIO handling. Patches have been released for affected stable kernel branches.
Affected products
- Linux Linux Kernel 6.16 to 6.16.9
Timeline
- 2025-09-12: other: Patch authored
- 2025-10-09: disclosed: CVE published
- 2025-10-09: advisory