CVE-2026-64023 (GCVE-0-2026-64023)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-08-05 12:38
VLAI
Title
gpio: aggregator: fix a potential use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: fix a potential use-after-free On error we free aggr->lookups->dev_id before removing the entry from the lookup table. If a concurrent thread calls gpiod_find() before we remove the entry, it could iterate over the list and call gpiod_match_lookup_table() which unconditionally dereferences dev_id when calling strcmp(). Reverse the order of cleanup.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8 , < ea28b286649b70618e9dd3e895812417a7712a11 (git)
Affected: 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8 , < 7ac4183a41ba048af89eddd82fe8be64619d0871 (git)
Affected: 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8 , < 30c073cab97afb31901f94de9605177b6b84367e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpio-aggregator.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea28b286649b70618e9dd3e895812417a7712a11",
              "status": "affected",
              "version": "86f162e73d2d81ef6d819c06a3b6c2fda77a79b8",
              "versionType": "git"
            },
            {
              "lessThan": "7ac4183a41ba048af89eddd82fe8be64619d0871",
              "status": "affected",
              "version": "86f162e73d2d81ef6d819c06a3b6c2fda77a79b8",
              "versionType": "git"
            },
            {
              "lessThan": "30c073cab97afb31901f94de9605177b6b84367e",
              "status": "affected",
              "version": "86f162e73d2d81ef6d819c06a3b6c2fda77a79b8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpio-aggregator.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: aggregator: fix a potential use-after-free\n\nOn error we free aggr-\u003elookups-\u003edev_id before removing the entry from\nthe lookup table. If a concurrent thread calls gpiod_find() before we\nremove the entry, it could iterate over the list and call\ngpiod_match_lookup_table() which unconditionally dereferences dev_id\nwhen calling strcmp(). Reverse the order of cleanup."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires writing to the gpio-aggregator configfs interface at /sys/kernel/config/gpio-aggregator/ (live attribute) or equivalent sysfs driver attributes; there is no network, adjacent, or physical attack path.\nAC:L - The attacker can reliably win the race by concurrently triggering failed aggregator activation (live=1 with probe-forcing config) and GPIO lookup activity (gpiod_find via parallel activations or device probing); both race sides are attacker-controlled.\nPR:L - Default configfs/sysfs access is root-only, but industrial/embedded GPIO-aggregator deployments commonly delegate configfs management to local service accounts; any local user with write access to the gpio-aggregator configfs tree can exploit without full init-namespace root.\nUI:N - Exploitation is fully attacker-driven through configfs writes and concurrent threads; no victim interaction is required.\nS:U - Impact is confined to kernel memory via the GPIO lookup-table UAF; this is standard local kernel privilege escalation/memory corruption, not a cross-boundary escape (VM, IOMMU, or sandbox).\nC:H - The use-after-free dereferences freed dev_id memory in strcmp() during gpiod_match_lookup_table(), enabling arbitrary kernel heap reads and information disclosure.\nI:H - Use-after-free on a global lookup-table entry can be leveraged with heap grooming for memory corruption and potential arbitrary write or code execution, not merely a bounded modification.\nA:H - Dereferencing freed dev_id memory can cause kernel oops/panic from invalid memory access; UAF bugs inherently threaten system availability even when not fully exploited."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:17.707Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea28b286649b70618e9dd3e895812417a7712a11"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ac4183a41ba048af89eddd82fe8be64619d0871"
        },
        {
          "url": "https://git.kernel.org/stable/c/30c073cab97afb31901f94de9605177b6b84367e"
        }
      ],
      "title": "gpio: aggregator: fix a potential use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64023",
    "datePublished": "2026-07-19T15:39:15.980Z",
    "dateReserved": "2026-07-19T07:54:57.027Z",
    "dateUpdated": "2026-08-05T12:38:17.707Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64023",
      "date": "2026-09-21",
      "epss": "0.00124",
      "percentile": "0.02442"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpio/gpio-aggregator.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ea28b286649b70618e9dd3e895812417a7712a11",
                    "status": "affected",
                    "version": "86f162e73d2d81ef6d819c06a3b6c2fda77a79b8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7ac4183a41ba048af89eddd82fe8be64619d0871",
                    "status": "affected",
                    "version": "86f162e73d2d81ef6d819c06a3b6c2fda77a79b8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "30c073cab97afb31901f94de9605177b6b84367e",
                    "status": "affected",
                    "version": "86f162e73d2d81ef6d819c06a3b6c2fda77a79b8",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpio/gpio-aggregator.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: aggregator: fix a potential use-after-free\n\nOn error we free aggr-\u003elookups-\u003edev_id before removing the entry from\nthe lookup table. If a concurrent thread calls gpiod_find() before we\nremove the entry, it could iterate over the list and call\ngpiod_match_lookup_table() which unconditionally dereferences dev_id\nwhen calling strcmp(). Reverse the order of cleanup."
          }
        ],
        "id": "CVE-2026-64023",
        "lastModified": "2026-07-30T14:59:47.950",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:42.317",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/30c073cab97afb31901f94de9605177b6b84367e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7ac4183a41ba048af89eddd82fe8be64619d0871"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ea28b286649b70618e9dd3e895812417a7712a11"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-22T00:50:38+00:00",
      "cve": "CVE-2026-64023",
      "id": "CVE-2026-64023",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gpio: aggregator: fix a potential use-after-free",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64023.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-30T16:33:30Z",
      "cve": "CVE-2026-64023",
      "id": "CVE-2026-64023",
      "initial_release_date": "2026-07-21T13:01:19Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64023",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64023.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.