Executive brief
A memory leak was identified in the Linux kernel's GPIO aggregator component, which is used to manage groups of General Purpose Input/Output pins. When a virtual GPIO device is deactivated, the system fails to properly release certain internal data structures. Over time, repeated activation and deactivation of these devices could consume system memory, potentially leading to performance degradation or stability issues.
Technical details
A resource leak exists in drivers/gpio/gpio-aggregator.c within the Linux kernel. When using the configfs interface to manage GPIO aggregators, the dynamic software node (fwnode) created for the aggregator platform device is not destroyed during the deactivation process. This occurs because the tear-down path in gpio_aggregator_deactivate() fails to call fwnode_remove_software_node(). An attacker with local access to the configfs interface could repeatedly trigger device deactivation to exhaust kernel memory. The issue has been resolved by ensuring the software node is explicitly removed as the final step of the deactivation sequence.
Affected products
- Linux Linux Kernel 6.16 to 6.18.33, 7.0.10, 7.1
Timeline
- 2026-05-20: disclosed: Initial patch submitted by Bartosz Golaszewski
- 2026-06-01: patched: Patch committed to stable trees
- 2026-07-19: advisory: CVE published to NVD dataset