---
id: "CVE-2026-99257"
kind: "vulnerability"
aliases: ["CVE-2026-99257"]
title: "Linux kernel: shared GPIO lookup without a device causes a NULL dereference"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["gpio", "linux-kernel", "runtime"]
not_affected_if: []
published_at: "2026-11-03T12:17:32+00:00"
first_seen_at: "2026-11-03T12:20:39+00:00"
updated_at: "2026-11-03T12:22:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99257", "first_seen_at": "2026-11-03T12:20:39+00:00"}]
---

# Linux kernel: shared GPIO lookup without a device causes a NULL dereference

A Linux kernel change fixes a NULL-pointer dereference when shared GPIOs are looked up by firmware node with no associated device. The fix makes the kernel return an error instead of crashing, and the sources do not describe any attacker-controlled path.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-03T12:20:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99257

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

gpio: shared: gracefully handle no-device lookup of shared GPIOs

We use platform lookup tables for shared GPIOs. This mechanism needs a
struct device to work so fwnode-based lookup with no device associated
currently causes a NULL-pointer deference.

Adding this functionality will require a larger rework and it has never
worked anyway so add a check that allows the kernel to gracefully handle
this situation with an error ahead of implementing that functionality as
a new feature.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_