Bug 2555004 (CVE-2026-98528) - CVE-2026-98528 kernel: gpio: cdev: fix kernel stack leak to user-space in error path
Summary: CVE-2026-98528 kernel: gpio: cdev: fix kernel stack leak to user-space in err...
Keywords:
Status: NEW
Alias: CVE-2026-98528
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-18 15:38 UTC by OSIDB Bzimport
Modified: 2026-10-19 17:11 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-18 15:38:38 UTC
In the Linux kernel, the following vulnerability has been resolved:

gpio: cdev: fix kernel stack leak to user-space in error path

If we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we
return immediately before zeroing the info struct we'll end up passing
to the user-space later in lineinfo_get_v1(). This may leak the kernel
stack contents. Make gpio_desc_to_lineinfo() return int so that the
-ENODEV returned on failure to acquire the guard can be propagated to
the callers.

While not strictly necessary: move the memset() before trying to acquire
the SRCU read lock too for good measure.


Note You need to log in before you can comment on or make changes to this bug.