CVE-2026-98528: gpio: cdev: fix kernel stack leak to user-space in error path
In the Linux kernel, the following vulnerability has been resolved:
gpio: cdev: fix kernel stack leak to user-space in error path
If we fail to acquire the GPIO chip guard in gpiodesctolineinfo(), we return immediately before zeroing the info struct we'll end up passing to the user-space later in lineinfogetv1(). This may leak the kernel stack contents. Make gpiodesctolineinfo() return int so that the -ENODEV returned on failure to acquire the guard can be propagated to the callers.
While not strictly necessary: move the memset() before trying to acquire the SRCU read lock too for good measure.
Affected Software
Event History
Frequently Asked Questions
Under what condition can kernel stack data be exposed?
The leak occurs when gpio_desc_to_lineinfo() cannot acquire the GPIO chip guard and returns before the line information structure is zeroed. The affected error path can then pass uninitialized kernel stack contents to user space through lineinfo_get_v1().
What behavior indicates that the fixed code is in use?
The corrected behavior propagates an -ENODEV error when acquisition of the GPIO chip guard fails, rather than returning line information containing uninitialized data. The fix also zeroes the information structure before attempting to acquire the SRCU read lock.