Technical impact
The Linux kernel’s reset GPIO driver creates a dynamic device that is meant to persist in memory. The driver exposes sysfs bind attributes, allowing user space to unbind the device. If an attacker unbinds it, the kernel dereferences freed memory, resulting in a use‑after‑free condition. This can corrupt data, crash the kernel, or provide a foothold for arbitrary code execution. The underlying weakness is a use‑after‑free condition (CWE‑416), compounded by improper event handling (CWE‑825).
Affected Systems
All Linux kernel builds that contain the unprotected reset GPIO sysfs bind attributes are affected. This includes any release prior to the patch that suppresses those attributes; there is no vendor‑specific restriction since the vulnerability resides in the core kernel code.
Risk and Exploitability
Exploitation requires the ability to write to the sysfs bind attribute, which typically demands local user privileges and access to the device’s directory under /sys. The attack vector is inferred from the description of unbinding the device via user space. The CVSS score is 7.8, and the EPSS score is <1%, indicating a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. As a result, the risk remains limited to local users with write access to the reset device’s sysfs directory; remote exploitation without additional privilege escalation remains unlikely.
