Technical impact
A flaw in the Linux kernel’s GPIO subsystem causes the reference count on a device structure to remain unreleased when the gpiochip_add_data_with_key() function encounters an error. This mismanagement can lead to a resource leak or, in the worst case, a double free that corrupts kernel memory. The vulnerability does not provide a direct remote code execution path; it would require an attacker to be able to trigger the specific error handling path within the kernel, implying a local privilege escalation or root context is necessary for exploitation.
Affected Systems
The issue affects Linux kernel builds that omit the commit aab5c6f20023 which introduced proper release handling. Because the affected versions are not enumerated in the CVE payload, systems running any kernel that predates this commit are potentially at risk. Distributions that provide a patched kernel, even if the exact release is not specified, are considered protected.
Risk and Exploitability
The CVSS score is 5.5, the EPSS score is < 1%—indicating a very low probability of exploitation—and the vulnerability is not listed in CISA’s KEV catalog, so quantitative risk estimates cannot be precisely defined. The likely attack vector requires local privilege or kernel context to trigger the error handling path, a condition inferred from the description; the risk evaluation is also inferred. Nonetheless, a double free in kernel code can trigger a panic or allow a local attacker to corrupt kernel memory, so the risk is non‑negligible for affected systems. The lack of a publicly documented exploit reduces the current threat level, but the kernel crash potential warrants timely remediation.
Debian DSA