CVE-2026-98528

CVE-2026-98528

published October 18, 2026

CVSS
—
EPSS
0%
Percentile
10.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

gpio: cdev: fix kernel stack leak to user-space in error path

If we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we

return immediately before zeroing the info struct we'll end up passing

to the user-space later in lineinfo_get_v1(). This may leak the kernel

stack contents. Make gpio_desc_to_lineinfo() return int so that the

-ENODEV returned on failure to acquire the guard can be propagated to

the callers.

While not strictly necessary: move the memset() before trying to acquire

the SRCU read lock too for good measure.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.4th percentile
Published
2026-10-18T20:17Z
References (4)
EPSS history
Timeline
  • 20 OCT 03:34Z
    EPSS moved — → 0%
    epss
  • 18 OCT 15:17Z
    gpio: cdev: fix kernel stack leak to user-space in error path
    cvelistv5
  • 18 OCT 15:17Z
    gpio: cdev: fix kernel stack leak to user-space in error path
    cvelistv5