CVE-2026-22986: gpiolib: fix race condition for gdev->srcu
In the Linux kernel, the following vulnerability has been resolved:
gpiolib: fix race condition for gdev->srcu
If two drivers were calling gpiochipadddatawithkey(), one may be traversing the srcu-protected list in gpionametodesc(), meanwhile other has just added its gdev in gpiodevaddtolistunlocked(). This creates a non-mutexed and non-protected timeframe, when one instance is dereferencing and using &gdev->srcu, before the other has initialized it, resulting in crash:
[ 4.935481] Unable to handle kernel paging request at virtual address ffff800272bcc000 [ 4.943396] Mem abort info: [ 4.943400] ESR = 0x0000000096000005 [ 4.943403] EC = 0x25: DABT (current EL), IL = 32 bits [ 4.943407] SET = 0, FnV = 0 [ 4.943410] EA = 0, S1PTW = 0 [ 4.943413] FSC = 0x05: level 1 translation fault [ 4.943416] Data abort info: [ 4.943418] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 4.946220] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 4.955261] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 4.955268] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000038e6c000 [ 4.961449] [ffff800272bcc000] pgd=0000000000000000 [ 4.969203] , p4d=1000000039739003 [ 4.979730] , pud=0000000000000000 [ 4.980210] phandle (CPU): 0x0000005e, phandle (BE): 0x5e000000 for node "reset" [ 4.991736] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP ... [ 5.121359] pc : srcureadlock+0x44/0x98 [ 5.131091] lr : gpionametodesc+0x60/0x1a0 [ 5.153671] sp : ffff8000833bb430 [ 5.298440] [ 5.298443] Call trace: [ 5.298445] srcureadlock+0x44/0x98 [ 5.309484] gpionametodesc+0x60/0x1a0 [ 5.320692] gpiochipadddatawithkey+0x488/0xf00 5.946419] ---[ end trace 0000000000000000 ]---
Move initialization code for gdev fields before it is added to gpiodevices, with adjacent initialization code. Adjust goto statements to reflect modified order of operations
[Bartosz: fixed a build issue, removed stray newline]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.15-1Fixed in 7.3.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22986?
CVE-2026-22986 is classified as a moderate severity vulnerability in the Linux kernel.
What issues does CVE-2026-22986 address?
CVE-2026-22986 addresses a race condition in the gpiolib affecting gpiochip_add_data_with_key() calls.
How do I fix CVE-2026-22986?
To fix CVE-2026-22986, you should update to the latest version of the Linux kernel where the vulnerability has been patched.
Who is affected by CVE-2026-22986?
CVE-2026-22986 affects systems utilizing the Linux kernel with specific GPIO driver implementations.
What are the potential impacts of CVE-2026-22986?
The potential impacts of CVE-2026-22986 include instability or crashes in systems when multiple drivers interact with GPIO.