Live › vulnerability › CVE-2026-98528
Go to dashboardWhen the GPIO chip guard cannot be acquired, the GPIO line info ioctl returns before clearing its output struct, so uninitialized kernel stack contents can be copied to user space. An attacker with access to the GPIO character device could read leftover kernel stack memory, which may contain pointers or other sensitive data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the gpio character device (/dev/gpiochip*) enabled, typically boards and servers using GPIO. Machines without GPIO chips exposed to users are less likely to matter, but the sources do not say which configurations are exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
gpio: cdev: fix kernel stack leak to user-space in error path
If we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we return immediately before zeroing the info struct we'll end up passing to the user-space later in lineinfo_get_v1(). This may leak the kernel stack contents. Make gpio_desc_to_lineinfo() return int so that the -ENODEV returned on failure to acquire the guard can be propagated to the callers.
While not strictly necessary: move the memset() before trying to acquire the SRCU read lock too for good measure.
This page as .md · .json · in your agent: get_signal("CVE-2026-98528")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.