Live › vulnerability › CVE-2026-99257
A Linux kernel change fixes a NULL-pointer dereference when shared GPIOs are looked up by firmware node with no associated device. The fix makes the kernel return an error instead of crashing, and the sources do not describe any attacker-controlled path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 12:20 UTC. All times on this page are UTC.
The sources describe a kernel GPIO shared-lookup path reached when no struct device is associated with a fwnode-based lookup. They do not say which kernel versions, hardware, or configurations reach that path, or whether an unprivileged user can trigger it. unknown
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
gpio: shared: gracefully handle no-device lookup of shared GPIOs
We use platform lookup tables for shared GPIOs. This mechanism needs a struct device to work so fwnode-based lookup with no device associated currently causes a NULL-pointer deference.
Adding this functionality will require a larger rework and it has never worked anyway so add a check that allows the kernel to gracefully handle this situation with an error ahead of implementing that functionality as a new feature.
This page as .md · .json · in your agent: get_signal("CVE-2026-99257")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.