CVE-2026-46258
NULL Dereference in Linux Kernel GPIO Character Device
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's gpio character device (cdev) subsystem, specifically in the function linehandle_create().
Within linehandle_create(), a pointer named 'lh' is assigned using retain_and_null_ptr(lh). However, shortly after, there is a debug print statement that dereferences 'lh' directly, which can lead to a NULL pointer dereference and cause the system to crash.
The fix involves avoiding the direct dereference of 'lh' and instead using handlereq.lines, which holds the same value but prevents the crash.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to a NULL pointer dereference in the gpio cdev subsystem.
A kernel crash can lead to system instability, unexpected reboots, or denial of service, which may disrupt normal operations on affected systems.