CVE-2026-64023: gpio: aggregator: fix a potential use-after-free
In the Linux kernel, the following vulnerability has been resolved:
gpio: aggregator: fix a potential use-after-free
On error we free aggr->lookups->devid before removing the entry from the lookup table. If a concurrent thread calls gpiodfind() before we remove the entry, it could iterate over the list and call gpiodmatchlookuptable() which unconditionally dereferences devid when calling strcmp(). Reverse the order of cleanup.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the gpio aggregator error cleanup path, remove the lookup-table entry before freeing aggr->lookups->dev_id; reverse the cleanup order to prevent gpiod_match_lookup_table() from dereferencing freed memory.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64023?
CVE-2026-64023 has a risk rating of 34, indicating it poses a moderate threat.
How do I fix CVE-2026-64023?
To fix CVE-2026-64023, ensure you update the Linux kernel to the latest version where the vulnerability has been patched.
What is the impact of CVE-2026-64023?
The impact of CVE-2026-64023 is a potential use-after-free condition that may lead to exploitation by concurrent threads.
Which software is affected by CVE-2026-64023?
CVE-2026-64023 affects the Linux kernel and its related modules.
When was CVE-2026-64023 published?
CVE-2026-64023 was published on July 19, 2026.