CVE-2026-98397: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown
In gpiosecondaryfwnodeinit(), acpibusfinddevicebyname() returns a device reference, but the local dev variable is declared with free(putdevice), dropping the reference at the end of each iteration. Meanwhile, devmaddactionorreset() saves the dev pointer for gpiosecondaryunset() without incrementing its reference count, which could lead to a use-after-free during driver teardown if the device is released in the interim.
Acquire an explicit device reference with getdevice() when registering the devres action, and drop it with putdevice() inside gpiosecondaryunset().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In gpio_secondary_fwnode_init(), acquire an explicit device reference with get_device() when registering the secondary fwnode, and release it with put_device() during gpio_secondary_unset() or teardown to prevent use-after-free.
Event History
Frequently Asked Questions
When can this use-after-free occur?
The issue can occur during driver teardown, if a device found by acpi_bus_find_device_by_name() is released after its pointer has been saved for the gpio_secondary_unset() devres action.
What component and configuration are implicated?
The affected code is in the Linux kernel's platform/x86 x86-android-tablets support, specifically secondary firmware-node handling in gpio_secondary_fwnode_init(). The provided information does not establish whether this support is enabled by default.
What change resolves the lifetime problem?
The fix takes an explicit device reference with get_device() when registering the devres action and releases that reference with put_device() in gpio_secondary_unset(). This keeps the saved device pointer valid until teardown cleanup runs.