CVE-2026-99162: gpio: shared: fix use-after-free bug when adding shared proxies

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

gpio: shared: fix use-after-free bug when adding shared proxies

The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup->devid. Fix a potential UAF by duplicating the string.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 28, 2026

CVE Published

via MITRE·10:35 AM

Data Sourced

via MITRE·10:35 AM

Description

Frequently Asked Questions

What condition triggers the use-after-free?

The issue can occur when adding shared GPIO proxies if a GPIO lookup table outlives the kobject whose name string address was assigned to lookup->dev_id.

How was the issue fixed?

The fix duplicates the kobject name string rather than retaining its address in lookup->dev_id, preventing the lookup table from referring to freed memory.

CVE-2026-99162: gpio: shared: fix use-after-free bug when adding shared proxies

Affected Software

Event History

Frequently Asked Questions

What condition triggers the use-after-free?

How was the issue fixed?

Company

Resources

Contact

Frequently Asked Questions

What condition triggers the use-after-free?

How was the issue fixed?