All vulnerabilities
CVE-2026-98971

Linux: gpio: exar: initialize the ID before registering its cleanup

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in01318927a9055136c207399eeb36ce07becac179Also 4d69e74034b208588636ecc177e0dd43a7696af3CVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 01318927a9055136c207399eeb36ce07becac179LinuxCVE List
  • 4d69e74034b208588636ecc177e0dd43a7696af3LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

gpio: exar: initialize the ID before registering its cleanup

devm_add_action_or_reset() invokes the cleanup action immediately when registering the action fails. gpio_exar_probe() currently stores the allocated ID in exar_gpio only after registering the action, so that failure makes exar_devm_ida_free() release ID 0. If the allocated ID is nonzero, this leaks that ID and can free ID 0 belonging to another device.

Store the ID before registering the cleanup action so both the immediate failure path and normal device teardown release the correct allocation.

Text from CVE List

Affected versions 12

  • Linuxaffected: 5300ebb695fa0672589ab191062392f686fca75d before bf3d841ef12fcbec4458e2750956b738b043a226CVE List
  • Linuxaffected: 5300ebb695fa0672589ab191062392f686fca75d before b78c114600ae3df90c083c72c290437b068577c8CVE List
  • Linuxaffected: 5300ebb695fa0672589ab191062392f686fca75d before 01318927a9055136c207399eeb36ce07becac179CVE List
  • Linuxaffected: 5300ebb695fa0672589ab191062392f686fca75d before f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2CVE List
  • Linuxaffected: 5300ebb695fa0672589ab191062392f686fca75d before 4d69e74034b208588636ecc177e0dd43a7696af3CVE List
  • Linuxaffected: 5.11CVE List
  • Linuxunaffected: all versions before 5.11CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5