Executive brief
A vulnerability was identified in the Linux kernel's GPIO (General Purpose Input/Output) subsystem, which manages how the operating system interacts with hardware pins. A flaw in the debug interface could allow a local user to trigger a system crash or potentially gain unauthorized access to sensitive information. This issue occurs when the system runs out of memory while trying to display hardware status information, leading to an invalid memory access.
Technical details
An invalid pointer access vulnerability exists in the Linux kernel's gpiolib component within the debugfs implementation. The root cause is located in gpiolib_seq_start(), where if a kzalloc() call fails, the s->private field of the seq_file structure remains uninitialized. Subsequently, gpiolib_seq_stop() attempts to dereference this uninitialized pointer without a NULL check. A local attacker with access to the debugfs GPIO interfaces could potentially trigger this condition to cause a kernel oops (denial of service) or achieve arbitrary code execution/privilege escalation. The fix involves explicitly initializing s->private to NULL and adding a validation check before dereferencing it in the stop sequence.
Affected products
- Linux Linux Kernel 6.9 to 6.12.57, 6.17.7
Timeline
- 2025-11-03: patched: Initial fix commit authored by Bartosz Golaszewski
- 2025-12-16: disclosed: CVE published