Executive brief
A vulnerability in the Linux kernel's GPIO (General Purpose Input/Output) subsystem could allow a local user to cause a resource leak. This occurs when the system fails to properly release memory during certain error conditions when adding new hardware components. Over time, this could lead to system instability or a denial-of-service condition as available memory is exhausted.
Technical details
A resource leak exists in the Linux kernel's GPIO subsystem within the `gpiochip_add_data_with_key()` function. Due to a regression introduced in commit aab5c6f20023, the `gdev->dev.release` callback was left unset, causing the reference count for the device object to remain undropped during error handling paths. An attacker with local access could potentially trigger these error paths to exhaust kernel memory. The fix involves ensuring `gpio_device_put()` is called on errors and reordering initialization steps to prevent double-free scenarios. Patches have been merged into various stable branches including 6.12.y and 6.18.y.
Affected products
- Linux Linux Kernel 6.9 to 6.12.y
Timeline
- 2026-02-05: patched: Initial fix authored by Tzung-Bi Shih
- 2026-05-01: disclosed: CVE published