{"id":"CVE-2026-98971","kind":"vulnerability","aliases":["CVE-2026-98971"],"related":[],"title":"Linux kernel: GPIO Exar driver can free the wrong IDA entry","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: exar: initialize the ID before registering its cleanup\n\ndevm_add_action_or_reset() invokes the cleanup action immediately when\nregistering the action fails.  gpio_exar_probe() currently stores the\nallocated ID in exar_gpio only after registering the action, so that\nfailure makes exar_devm_ida_free() release ID 0.  If the allocated ID is\nnonzero, this leaks that ID and can free ID 0 belonging to another device.\n\nStore the ID before registering the cleanup action so both the immediate\nfailure path and normal device teardown release the correct allocation.","summary":"In the Linux kernel's Exar GPIO driver, a failed cleanup registration makes the probe path release ID 0 instead of the device's own allocated ID. An attacker is not described as gaining code execution or data access; the flaw can leak an ID and free an ID belonging to another device.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["exar-gpio","linux-kernel","package"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-23T13:17:18+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:56:24+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:56:24Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: GPIO Exar driver can free the wrong IDA entry","impact":"low","summary":"In the Linux kernel's Exar GPIO driver, a failed cleanup registration makes the probe path release ID 0 instead of the device's own allocated ID. An attacker is not described as gaining code execution or data access; the flaw can leak an ID and free an ID belonging to another device.","category":"package","nicknames":[],"who_cares":["linux-kernel","exar-gpio"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Wrong device ID freed, causing ID leak or collision.","analyst_note":"Check the NVD entry and the upstream kernel commit for affected kernel versions and fixed stable releases.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000523,"input_tokens":3426,"output_tokens":361,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98971':14A,17A '0':43B,138C,153C 'access':63B 'action':99C,105C,110C,127C,165C 'add':98C 'alloc':50B,118C,141C,179C 'anoth':76B,156C 'attack':53B 'belong':74B,154C 'cleanup':35B,96C,104C,164C 'code':59B 'correct':178C 'current':115C 'cve':12A,15A 'data':62B 'describ':56B 'devic':47B,77B,157C,174C 'devm':97C,133C 'driver':5A,32B 'entri':11A 'exar':4A,19B,30B,89C,113C,121C,132C 'exar-gpio':18B 'execut':60B 'fail':34B,111C 'failur':130C,170C 'flaw':65B 'follow':83C 'free':7A,71B,135C,151C 'gain':58B 'gpio':3A,20B,31B,88C,112C,122C 'id':42B,51B,69B,73B,92C,119C,137C,142C,148C,152C,160C 'ida':10A,134C 'immedi':106C,169C 'initi':90C 'instead':44B 'invok':102C 'kernel':2A,23B,28B,81C 'leak':67B,146C 'linux':1A,22B,27B,80C 'linux-kernel':21B 'make':37B,131C 'nonzero':144C 'normal':173C 'packag':24B 'path':40B,171C 'probe':39B,114C 'regist':94C,108C,125C,162C 'registr':36B 'releas':41B,136C,176C 'reset':101C 'resolv':87C 'store':116C,158C 'teardown':175C 'vulner':84C 'wrong':9A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98971","severity":null,"published_at":"2026-10-23T13:17:18+00:00","modified_at":"2026-10-23T13:17:18+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98971","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98971","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}