All vulnerabilities
CVE-2026-99190

Linux: gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in78189c0e35abbcdab3b8ab0b764d578c02900734Also 890c3bf08e0fc09eff788a6cfeded7d21b4d3e9d, 6.13CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 78189c0e35abbcdab3b8ab0b764d578c02900734LinuxCVE List
  • 890c3bf08e0fc09eff788a6cfeded7d21b4d3e9dLinuxCVE List
  • 6.13LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths

A drive-by review by Sashiko reports that, after a failed call to gpiochip_set_multiple(), gpiod_set_array_value() returns abruptly, bypassing the freeing of possibly alloced bitmaps, potentially leaking memory. It is an unlikely error path, but is possible.

Defer the return code check until after the bitmap_free() block.

Text from CVE List

Affected versions 10

  • Linuxaffected: 9b407312755fd5db012413ca005f0f3a661db8dd before 78189c0e35abbcdab3b8ab0b764d578c02900734CVE List
  • Linuxaffected: 9b407312755fd5db012413ca005f0f3a661db8dd before 890c3bf08e0fc09eff788a6cfeded7d21b4d3e9dCVE List
  • Linuxaffected: 9b407312755fd5db012413ca005f0f3a661db8dd before c28846ca1ac6134881114d272314623c8433e372CVE List
  • Linuxaffected: d73d2a569e6212f58d89efc6e66ffbb2386a47b1CVE List
  • Linuxaffected: 6.12.114 before 6.13CVE List
  • Linuxaffected: 6.15CVE List
  • Linuxunaffected: all versions before 6.15CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3