All vulnerabilities
CVE-2026-98397

Linux: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in144113b0a70fa18033a747ee5db6803308f7688cFixed versionCVE List
Published14 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 144113b0a70fa18033a747ee5db6803308f7688cLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown

In gpio_secondary_fwnode_init(), acpi_bus_find_device_by_name() returns a device reference, but the local dev variable is declared with __free(put_device), dropping the reference at the end of each iteration. Meanwhile, devm_add_action_or_reset() saves the dev pointer for gpio_secondary_unset() without incrementing its reference count, which could lead to a use-after-free during driver teardown if the device is released in the interim.

Acquire an explicit device reference with get_device() when registering the devres action, and drop it with put_device() inside gpio_secondary_unset().

Text from CVE List

Affected versions 6

  • Linuxaffected: 1448c2d2ca5cc7f4ea6694e6bc809946de0a751c before c62b6e081119f2ab03cfcafde1f83c0f50e8e726CVE List
  • Linuxaffected: 1448c2d2ca5cc7f4ea6694e6bc809946de0a751c before 144113b0a70fa18033a747ee5db6803308f7688cCVE List
  • Linuxaffected: 7.2CVE List
  • Linuxunaffected: all versions before 7.2CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2