Executive brief
A vulnerability in the Linux kernel's GPIO-based reset controller could allow a local user to crash the system or potentially execute unauthorized actions. The issue occurs because the system allows users to manually disconnect a specific internal component that is required to stay in memory. If disconnected, other parts of the system trying to use that component will encounter a memory error, leading to instability or security breaches.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's reset-gpio driver (drivers/reset/reset-gpio.c). The vulnerability is rooted in the lack of a devlink between the dynamically created reset device and its consumers, combined with the exposure of bind/unbind attributes in sysfs. A local attacker with sufficient privileges to interact with sysfs can trigger an unbind of the device; subsequent attempts by consumers to release or use the reset control handle result in a use-after-free condition. The fix involves setting suppress_bind_attrs to true in the platform and auxiliary driver structures to prevent manual unbinding from userspace.
Affected products
- Linux Linux kernel 6.9 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2025-12-04: other: Patch authored
- 2026-05-06: disclosed: CVE published
- 2026-05-12: advisory: NIST analysis completed