CVE-2026-64023
Received Received - Intake

GPIO Aggregator Use-After-Free in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: fix a potential use-after-free On error we free aggr->lookups->dev_id before removing the entry from the lookup table. If a concurrent thread calls gpiod_find() before we remove the entry, it could iterate over the list and call gpiod_match_lookup_table() which unconditionally dereferences dev_id when calling strcmp(). Reverse the order of cleanup.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64023
EUVD
EUVD-2026-45596

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the GPIO aggregator module. When an error occurs, the cleanup process frees a device identifier before removing the entry from the lookup table. If another thread accesses the table concurrently, it may dereference the freed memory, leading to potential crashes or unexpected behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's GPIO aggregator module and may not have direct network detection methods. Check kernel logs for errors related to gpio or aggregator with commands like dmesg | grep -i gpio or journalctl -k | grep -i gpio. If you suspect exploitation, monitor for unexpected process crashes or system instability.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior if exploited. It may lead to privilege escalation or denial-of-service conditions on affected Linux systems using the GPIO aggregator feature.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel issue involving a potential use-after-free in GPIO aggregator functionality. No evidence suggests it impacts data protection or privacy requirements.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this issue. If immediate patching is not possible, disable the GPIO aggregator module by running modprobe -r gpio_aggregator as a temporary workaround. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64023. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart