CVE-2026-31745
Awaiting Analysis Awaiting Analysis - Queue
Double Free in Linux Kernel GPIO Reset Driver

Publication date: 2026-05-01

Last updated on: 2026-05-01

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: reset: gpio: fix double free in reset_add_gpio_aux_device() error path When __auxiliary_device_add() fails, reset_add_gpio_aux_device() calls auxiliary_device_uninit(adev). The device release callback reset_gpio_aux_device_release() frees adev, but the current error path then calls kfree(adev) again, causing a double free. Keep kfree(adev) for the auxiliary_device_init() failure path, but avoid freeing adev after auxiliary_device_uninit().
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-01
Last Modified
2026-05-01
Generated
2026-05-07
AI Q&A
2026-05-02
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?

The vulnerability is fixed in the Linux kernel by correcting the double free error in the reset_add_gpio_aux_device() function. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

  • Check your current kernel version using: uname -r
  • Update the Linux kernel to the latest stable release provided by your distribution or from the official Linux kernel sources.
  • Reboot your system to load the updated kernel.

Can you explain this vulnerability to me?

This vulnerability is a double free bug in the Linux kernel's reset subsystem related to GPIO auxiliary devices. Specifically, when the function __auxiliary_device_add() fails, the error handling path in reset_add_gpio_aux_device() calls auxiliary_device_uninit(), which triggers the device release callback reset_gpio_aux_device_release() to free the auxiliary device structure (adev). However, after this callback, the error path attempts to free the same structure again using kfree(adev), causing a double free.

The fix involves keeping the kfree(adev) call only for the failure path of auxiliary_device_init(), and avoiding freeing adev after auxiliary_device_uninit() to prevent the double free.


How can this vulnerability impact me? :

A double free vulnerability can lead to undefined behavior such as memory corruption, system crashes, or potential exploitation by attackers to execute arbitrary code or escalate privileges. In the context of the Linux kernel, this could compromise system stability and security.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart