CVE-2026-80563
Received Received - Intake

Use-After-Free in Linux Kernel GPIO Sloppy Logic Analyzer

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind The "trigger" debugfs file has a hand-rolled ->write handler (trigger_write()) that dereferences the per-device gpio_la_poll_priv. The file is created with debugfs_create_file_unsafe(), and the handler never takes a debugfs reference. Nothing keeps the object alive while the handler runs. priv is allocated with devm_kzalloc(). devres frees it when the platform device is unbound. debugfs_create_file_unsafe() installs no full_proxy wrapper, so debugfs_remove_recursive() in gpio_la_poll_remove() does not wait for an in-flight trigger_write(). The blob_lock taken there does not help, because trigger_write() never takes it. A write that races an unbind therefore writes into freed memory: trigger_write() gpio_la_poll_remove() priv = m->private buf = memdup_user() [may sleep] mutex_lock(&priv->blob_lock) debugfs_remove_recursive() [no wait] mutex_unlock(&priv->blob_lock) (remove returns; devres frees priv) priv->trig_data = buf <-- use-after-free write priv->trig_len = count The race is reachable by root via /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind. Create "trigger" with debugfs_create_file() instead. Its full_proxy wrapper makes debugfs_remove_recursive() drain any in-flight ->write before it returns. The use-after-free is confirmed under KASAN with a minimal reproducer of the same debugfs_create_file_unsafe() plus devm_kzalloc() pattern (available on request); it produces a slab-use-after-free write in the handler.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-09-16
AI Q&A
2026-08-26
EPSS Evaluated
2026-09-14
NVD
CVE-2026-80563
EUVD
EUVD-2026-66478

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's gpio-sloppy-logic-analyzer driver. It occurs when a debugfs file's write handler accesses freed memory due to a race condition between device unbinding and file operations. The issue stems from using debugfs_create_file_unsafe() without proper synchronization, allowing a write to trigger after the device's memory is freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's gpio-sloppy-logic-analyzer driver and requires local access to the system. It cannot be detected remotely via network commands. Check if the affected driver is loaded using: lsmod | grep gpio_sloppy_logic_analyzer. If present, inspect debugfs for the trigger file under /sys/kernel/debug/gpio_sloppy_logic_analyzer/

Impact Analysis

An attacker with root access could exploit this to execute arbitrary code or crash the system by triggering a write to a debugfs file while the device is being unbound. This could lead to denial-of-service or potential privilege escalation on affected systems.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's GPIO sloppy logic analyzer driver, which could allow local root users to write into freed memory via a debugfs trigger. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety issues.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If immediate patching is not possible, unload the gpio-sloppy-logic-analyzer module using: sudo modprobe -r gpio_sloppy_logic_analyzer. Avoid using the debugfs trigger file until the system is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80563. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart