CVE-2026-80563: gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind

Published Aug 26, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind

The "trigger" debugfs file has a hand-rolled ->write handler (triggerwrite()) that dereferences the per-device gpiolapollpriv. The file is created with debugfscreatefileunsafe(), and the handler never takes a debugfs reference. Nothing keeps the object alive while the handler runs.

priv is allocated with devmkzalloc(). devres frees it when the platform device is unbound. debugfscreatefileunsafe() installs no fullproxy wrapper, so debugfsremoverecursive() in gpiolapollremove() does not wait for an in-flight triggerwrite(). The bloblock taken there does not help, because triggerwrite() never takes it. A write that races an unbind therefore writes into freed memory:

triggerwrite() gpiolapollremove() priv = m->private buf = memdupuser() [may sleep] mutexlock(&priv->bloblock) debugfsremoverecursive() [no wait] mutexunlock(&priv->bloblock) (remove returns; devres frees priv) priv->trigdata = buf <-- use-after-free write priv->triglen = count

The race is reachable by root via /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind.

Create "trigger" with debugfscreatefile() instead. Its fullproxy wrapper makes debugfsremoverecursive() drain any in-flight ->write before it returns.

The use-after-free is confirmed under KASAN with a minimal reproducer of the same debugfscreatefileunsafe() plus devmkzalloc() pattern (available on request); it produces a slab-use-after-free write in the handler.

Affected Software

1 affected component
The Linux Kernel Project Linux Kernel

Event History

Aug 26, 2026
CVE Published
via MITRE·02:37 PM
Data Sourced
via MITRE·02:37 PM
Description
Data Sourced
via NVD·03:17 PM
Description

Frequently Asked Questions

1

Who can trigger this issue?

The race is reachable by root, which must be able to write to the driver's debugfs trigger file while the associated platform device is being unbound.

2

What conditions are required for exploitation?

An in-flight trigger_write() operation must race with device unbind and removal of the debugfs entries. The write handler can sleep after copying user data, allowing removal to complete and devres to free the per-device allocation before the handler updates it.

3

Does the debugfs removal path prevent the race?

No. The trigger file is created with debugfs_create_file_unsafe(), so debugfs_remove_recursive() does not wait for an in-flight write handler, and the handler does not take the blob_lock used during removal.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203