CVE-2026-64023

7.8 Élevée

Publiée le 19/07/2026 à 18:17 · Modifiée le 13/10/2026 à 16:57 · Analysée par le NVD · Source : 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Description

In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: fix a potential use-after-free On error we free aggr->lookups->dev_id before removing the entry from the lookup table. If a concurrent thread calls gpiod_find() before we remove the entry, it could iterate over the list and call gpiod_match_lookup_table() which unconditionally dereferences dev_id when calling strcmp(). Reverse the order of cleanup.

Traduire en français

Produits concernés

Linux
Linux linux kernel

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.8 Élevée	416baaa9-dc9f-4396-8d5f-8c081fb06d67	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-416

Références

https://git.kernel.org/stable/c/30c073cab97afb31901f94de9605177b6b84367e Patch
https://git.kernel.org/stable/c/7ac4183a41ba048af89eddd82fe8be64619d0871 Patch
https://git.kernel.org/stable/c/ea28b286649b70618e9dd3e895812417a7712a11 Patch

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories