Executive brief
A vulnerability in the Linux kernel's GPIO (General Purpose Input/Output) subsystem could allow a local user to cause a system instability or resource leak. When certain hardware controllers are removed while their pins are still being monitored by the system, the kernel fails to properly clean up internal references. This can lead to persistent 'ghost' attributes in the system's file structure and potential memory management issues.
Technical details
A race condition and reference counting issue exists in drivers/gpio/gpiolib-sysfs.c. When a GPIO is exported via sysfs and the parent GPIO controller is subsequently unbound, gpiod_unexport() fails to associate the descriptor with the parent device, preventing the final reference from being dropped. This results in exported attributes remaining under /sys/class/gpio. The fix introduces an unlocked variant of gpiod_unexport() and ensures all exported GPIOs are removed while holding the sysfs_lock before the parent device is unregistered.
Affected products
- Linux Linux Kernel 6.17 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-02-12: patched: Initial patch authored by Bartosz Golaszewski
- 2026-05-06: disclosed: CVE published