CVE-2026-23015: gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths
In the Linux kernel, the following vulnerability has been resolved:
gpio: mpsse: fix reference leak in gpiompsseprobe() error paths
The reference obtained by calling usbgetdev() is not released in the gpiompsseprobe() error paths. Fix that by using device managed helper functions. Also remove the usbputdev() call in the disconnect function since now it will be released automatically.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the gpio_mpsse driver, remove the usb_put_dev() call from the disconnect function and fix the gpio_mpsse_probe() error paths by using a device-managed helper so the usb_get_dev() reference is released automatically.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23015?
The severity of CVE-2026-23015 is classified as low due to its limited impact on system security.
How do I fix CVE-2026-23015?
To fix CVE-2026-23015, upgrade to the latest version of the Linux kernel where the vulnerability has been patched.
What systems are affected by CVE-2026-23015?
CVE-2026-23015 affects certain versions of the Linux kernel that utilize the MPSSE GPIO interface.
What type of vulnerability is CVE-2026-23015?
CVE-2026-23015 is a reference leak vulnerability occurring in the GPIO MPSSE probe process within the Linux kernel.
What are the potential consequences of CVE-2026-23015?
The main consequence of CVE-2026-23015 is a resource leak, which could potentially lead to degraded performance over time.