Is CVE-2026-99257 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-99257 being exploited in the wild.

How severe is CVE-2026-99257?

Informational severity, published 3 November 2026.

Which products and versions are affected?

Unknown Linux kernel All versions from introduction of shared GPIO support (commit a060b8c511ab) prior to this fix.

Is there a fix for CVE-2026-99257?

A patch was published on 2026-10-15: Original fix commit cf73c3fc03c43a8a86fd487c62390b4744eff9ec Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-99257 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-99257?

Check whether you run Unknown Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-99257: Linux kernel GPIO null pointer dereference in shared GPIO lookup

CVE-2026-99257 · Severity: info · Published 2026-11-03

A Linux kernel bug could cause a system crash when certain GPIO lookup operations are performed without a device reference. This is a stability issue that prevents the kernel from running properly in specific hardware configurations, but does not allow attackers to gain unauthorized access or data.

Technologies: Unknown Linux kernel. Vendors: Unknown.

Quick answers

Is CVE-2026-99257 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-99257 being exploited in the wild.
How severe is CVE-2026-99257?: Informational severity, published 3 November 2026.
Which products and versions are affected?: Unknown Linux kernel All versions from introduction of shared GPIO support (commit a060b8c511ab) prior to this fix.
Is there a fix for CVE-2026-99257?: A patch was published on 2026-10-15: Original fix commit cf73c3fc03c43a8a86fd487c62390b4744eff9ec Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-99257 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-99257?: Check whether you run Unknown Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A null pointer dereference occurs in the GPIO shared library when gpio_shared_add_proxy_lookup() is called with a NULL consumer device pointer during fwnode-based GPIO lookup. The vulnerability is in drivers/gpio/gpiolib-shared.c where dev_name(consumer) was dereferenced without checking if consumer was NULL. The fix adds a bounds check that returns -EOPNOTSUPP if consumer is NULL, gracefully handling this unsupported scenario.

Affected products

<UNKNOWN> Linux kernel All versions from introduction of shared GPIO support (commit a060b8c511ab) prior to this fix

Timeline

2026-11-03: disclosed
2026-10-15: patched: Original fix commit cf73c3fc03c43a8a86fd487c62390b4744eff9ec
2026-11-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.