CVE-2026-98397

Received Received - Intake

Use-After-Free in Linux Kernel x86 Android Tablets Driver

Publication date: 2026-10-14

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpio_secondary_fwnode_init(), acpi_bus_find_device_by_name() returns a device reference, but the local dev variable is declared with __free(put_device), dropping the reference at the end of each iteration. Meanwhile, devm_add_action_or_reset() saves the dev pointer for gpio_secondary_unset() without incrementing its reference count, which could lead to a use-after-free during driver teardown if the device is released in the interim. Acquire an explicit device reference with get_device() when registering the devres action, and drop it with put_device() inside gpio_secondary_unset().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98397

EUVD

EUVD-2026-101046

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1448c2d2ca5cc7f4ea6694e6bc809946de0a751c
Linux	Linux	1448c2d2ca5cc7f4ea6694e6bc809946de0a751c
Linux	Linux	7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's x86-android-tablets driver. It involves improper handling of device references during driver teardown. A function called gpio_secondary_fwnode_init() gets a device reference but drops it prematurely due to incorrect cleanup handling. This can lead to a use-after-free issue when the device is released while the driver is still trying to access it.

Detection Guidance

This vulnerability is specific to the Linux kernel's x86-android-tablets driver and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the driver's presence and version. Commands like dmesg, journalctl, or checking /proc/version may help identify affected systems.

Impact Analysis

If exploited, this vulnerability could cause system crashes, data corruption, or unauthorized access. It primarily affects systems using the Linux kernel with x86-android-tablets driver, potentially leading to denial-of-service conditions or privilege escalation if an attacker triggers the use-after-free scenario.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free issue in the Linux kernel's x86-android-tablets driver, which could lead to system instability or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch this issue. If immediate patching is not possible, consider disabling the x86-android-tablets driver if unused. Monitor kernel security advisories for updates.

Hi! I’m here to help you understand CVE-2026-98397. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70