{"id":"CVE-2026-98528","kind":"vulnerability","aliases":["CVE-2026-98528"],"related":[],"title":"Linux kernel: GPIO character device error path leaks kernel stack bytes","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: cdev: fix kernel stack leak to user-space in error path\n\nIf we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we\nreturn immediately before zeroing the info struct we'll end up passing\nto the user-space later in lineinfo_get_v1(). This may leak the kernel\nstack contents. Make gpio_desc_to_lineinfo() return int so that the\n-ENODEV returned on failure to acquire the guard can be propagated to\nthe callers.\n\nWhile not strictly necessary: move the memset() before trying to acquire\nthe SRCU read lock too for good measure.","summary":"When the GPIO chip guard cannot be acquired, the GPIO line info ioctl returns before clearing its output struct, so uninitialized kernel stack contents can be copied to user space. An attacker with access to the GPIO character device could read leftover kernel stack memory, which may contain pointers or other sensitive data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","gpio","infrastructure","linux-kernel"],"not_affected_if":["no-gpio-chardev"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream gpio: cdev fix (version unknown from sources)","status":"open","published_at":"2026-10-18T16:17:04+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:07+00:00","updated_at":"2026-10-25T05:25:07+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:25:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream gpio: cdev fix (version unknown from sources)","reach":"local","title":"Linux kernel: GPIO character device error path leaks kernel stack bytes","impact":"low","summary":"When the GPIO chip guard cannot be acquired, the GPIO line info ioctl returns before clearing its output struct, so uninitialized kernel stack contents can be copied to user space. An attacker with access to the GPIO character device could read leftover kernel stack memory, which may contain pointers or other sensitive data.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","gpio","embedded"],"confidence":0.5,"needs_auth":"yes","worst_case":"kernel stack memory readable by a local user","analyst_note":"Confirm the fixed kernel versions and the exact trigger condition from the upstream kernel commit or NVD entry.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-gpio-chardev"],"who_is_affected":"Systems running a Linux kernel with the gpio character device (/dev/gpiochip*) enabled, typically boards and servers using GPIO. Machines without GPIO chips exposed to users are less likely to matter, but the sources do not say which configurations are exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000591,"input_tokens":3443,"output_tokens":493,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98528':14A,17A 'access':57B 'acquir':31B,104C,159C,178C 'attack':55B 'byte':11A 'caller':167C 'cannot':29B 'cdev':88C 'charact':4A,61B 'chip':27B,107C 'clear':39B 'contain':71B 'content':47B,143C 'copi':50B 'could':63B 'cve':12A,15A 'data':76B 'desc':111C,146C 'devic':5A,62B 'embed':18B 'end':124C 'enodev':154C 'error':6A,98C 'fail':102C 'failur':157C 'fix':89C 'follow':82C 'get':135C 'good':185C 'gpio':3A,19B,26B,33B,60B,87C,106C,110C,145C 'guard':28B,108C,161C 'immedi':116C 'info':35B,120C 'infrastructur':20B 'int':150C 'ioctl':36B 'kernel':2A,9A,23B,45B,66B,80C,90C,141C 'later':132C 'leak':8A,92C,139C 'leftov':65B 'line':34B 'lineinfo':113C,134C,148C 'linux':1A,22B,79C 'linux-kernel':21B 'll':123C 'lock':182C 'make':144C 'may':70B,138C 'measur':186C 'memori':68B 'memset':174C 'move':172C 'necessari':171C 'output':41B 'pass':126C 'path':7A,99C 'pointer':72B 'propag':164C 'read':64B,181C 'resolv':86C 'return':37B,115C,149C,155C 'sensit':75B 'space':53B,96C,131C 'srcu':180C 'stack':10A,46B,67B,91C,142C 'strict':170C 'struct':42B,121C 'tri':176C 'uniniti':44B 'user':52B,95C,130C 'user-spac':94C,129C 'v1':136C 'vulner':83C 'zero':118C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the gpio character device (/dev/gpiochip*) enabled, typically boards and servers using GPIO. Machines without GPIO chips exposed to users are less likely to matter, but the sources do not say which configurations are exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98528","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98528","severity":null,"published_at":"2026-10-18T16:17:04+00:00","modified_at":"2026-10-19T10:19:08+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}