Executive brief
A use-after-free vulnerability exists in the Linux kernel's gpio-sloppy-logic-analyzer driver when handling debugfs operations during device unbind. An authenticated user can trigger the flaw by writing to the debugfs "trigger" file while the device is being removed, potentially causing memory corruption or a kernel crash.
Technical details
The vulnerability is a use-after-free in the trigger_write() handler of the gpio-sloppy-logic-analyzer driver. The "trigger" debugfs file is created with debugfs_create_file_unsafe(), which does not install a full_proxy wrapper to serialize access. The per-device gpio_la_poll_priv structure is allocated with devm_kzalloc(), meaning it is freed when the platform device is unbound. A race condition occurs when trigger_write() is in-flight (after reading priv but before dereferencing it) while gpio_la_poll_remove() calls debugfs_remove_recursive() and the device is unbound; the latter frees priv via devres, and trigger_write() then writes into freed memory. The attack requires root privilege to unbind the device via /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind. The fix is to replace debugfs_create_file_unsafe() with debugfs_create_file() to enable the full_proxy wrapper, ensuring debugfs_remove_recursive() waits for in-flight handlers.
Affected products
- Linux Linux kernel affected versions not explicitly specified; fix included in kernel repository
Timeline
- 2026-08-26: disclosed