CVE-2026-99050: gpio: mpsse: fix race when arming the IRQ poll worker
In the Linux kernel, the following vulnerability has been resolved:
gpio: mpsse: fix race when arming the IRQ poll worker
gpiompsseirqenable() arms the poll worker before publishing it: schedulework() runs before the worker is added to priv->workers. If gpiompssedisconnect() walks the list in that window it misses the worker, and once disconnect returns, the USB core frees mpssepriv while the orphaned gpiompssepoll() work keeps accessing it, causing a use-after-free.
Fix this by publishing and arming the worker in one irqspin critical section. Teardown walks the same list under irqspin, so a worker found on the list is guaranteed to be armed, and cancelworksync() handles it whether it is queued or running.
A worker armed after the disconnect walk would still be missed, so also set a new priv->dying flag under irqspin before the teardown walk, and check it in the same critical section, freeing it via kfreercu() instead when the device is going away, since kfree() would be called with the IRQ core's raw spinlock held and may sleep on PREEMPTRT. schedulework() is safe to call with irqspin held, and the next probe gets a fresh mpssepriv, so the flag never needs to be cleared.
This issue was found by an in-house static analysis tool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the gpio:mpsse teardown and IRQ-worker code so that the worker is published and armed within the same irq_spin critical section; set and check priv->dying under irq_spin before teardown; use cancel_work_sync() for queued or running work; and free the device state with kfree_rcu() instead of kfree() while orphaned gpio_mpsse_poll() work may still access it.