CVE-2026-98971 - Vulnerability Details

- gpio: exar: initialize the ID before registering its cleanup

Description

In the Linux kernel, the following vulnerability has been resolved:

gpio: exar: initialize the ID before registering its cleanup

devm_add_action_or_reset() invokes the cleanup action immediately when
registering the action fails. gpio_exar_probe() currently stores the
allocated ID in exar_gpio only after registering the action, so that
failure makes exar_devm_ida_free() release ID 0. If the allocated ID is
nonzero, this leaks that ID and can free ID 0 belonging to another device.

Store the ID before registering the cleanup action so both the immediate
failure path and normal device teardown release the correct allocation.

Published: 2026-10-23

Score: 4.1 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel’s exar GPIO driver causes the driver to store an allocated ID only after the cleanup action is registered. If registering the cleanup fails, the driver immediately calls the cleanup routine, freeing ID 0 even if the allocated ID was non‑zero. Consequently the ID 0 belonging to another device is leaked, potentially allowing that device to be re‑taken or misused. The vulnerability arises from improper initialization of the device ID before cleanup registration, leading to resource leakage and interference with other devices.

Affected Systems

All Linux kernel releases prior to the patch that corrects the exar GPIO driver. The affected vendor is Linux and the product is the Linux kernel. No specific version list is supplied, so all builds containing the unpatched driver are susceptible.

Risk and Exploitability

The CVE has a CVSS score of 4.1, and the EPSS score is < 1%. It is not listed in CISA’s KEV catalog. Based on the description, exploitation would require controlling the device probing process to trigger the faulty cleanup path. No public exploits have been reported, implying a low exploitation likelihood. However, the bug can cause kernel instability or unexpected device behavior, which is a moderate operational risk.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5300ebb695fa0672589ab191062392f686fca75d`	affected	< 0250acba81654b2ee50bde324ad72b3f0c04d0bd
`5300ebb695fa0672589ab191062392f686fca75d`	affected	< 88b9c4bbf83d940ab672956e5af921215905dcb4
`5300ebb695fa0672589ab191062392f686fca75d`	affected	< bf3d841ef12fcbec4458e2750956b738b043a226
`5300ebb695fa0672589ab191062392f686fca75d`	affected	< b78c114600ae3df90c083c72c290437b068577c8
`5300ebb695fa0672589ab191062392f686fca75d`	affected	< 01318927a9055136c207399eeb36ce07becac179
`5300ebb695fa0672589ab191062392f686fca75d`	affected	< f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2
`5300ebb695fa0672589ab191062392f686fca75d`	affected	< 4d69e74034b208588636ecc177e0dd43a7696af3

Linux

affected

Version	Status	Constraints
`5.11`	affected	—
`0`	unaffected	< 5.11
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[5300ebb695fa0672589ab191062392f686fca75d,bf3d841ef12fcbec4458e2750956b738b043a226)`	affected	code_commit	—
`[5300ebb695fa0672589ab191062392f686fca75d,b78c114600ae3df90c083c72c290437b068577c8)`	affected	code_commit	—
`[5300ebb695fa0672589ab191062392f686fca75d,01318927a9055136c207399eeb36ce07becac179)`	affected	code_commit	—
`[5300ebb695fa0672589ab191062392f686fca75d,f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2)`	affected	code_commit	—
`[5300ebb695fa0672589ab191062392f686fca75d,4d69e74034b208588636ecc177e0dd43a7696af3)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`5.11`	affected	semver	—
`[0,5.11)`	unaffected	semver	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5300ebb695fa0672589ab191062392f686fca75d,bf3d841ef12fcbec4458e2750956b738b043a226)`	affected	code_commit	—
`[5300ebb695fa0672589ab191062392f686fca75d,b78c114600ae3df90c083c72c290437b068577c8)`	affected	code_commit	—
`[5300ebb695fa0672589ab191062392f686fca75d,01318927a9055136c207399eeb36ce07becac179)`	affected	code_commit	—
`[5300ebb695fa0672589ab191062392f686fca75d,f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2)`	affected	code_commit	—
`[5300ebb695fa0672589ab191062392f686fca75d,4d69e74034b208588636ecc177e0dd43a7696af3)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`5.11`	affected	semver	—
`[0,5.11)`	unaffected	semver	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the system to a kernel release that contains the patch for the exar GPIO driver.
If an immediate kernel update is not available, apply the upstream patch that reorders ID assignment to occur before cleanup registration.
Reboot the system after applying the patch to ensure the driver is reloaded with the corrected cleanup logic.

Generated by OpenCVE AI on October 29, 2026 at 22:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00206.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98971.mbox
https://git.kernel.org/stable/c/01318927a9055136c207399eeb36ce07becac179
https://git.kernel.org/stable/c/0250acba81654b2ee50bde324ad72b3f0c04d0bd
https://git.kernel.org/stable/c/4d69e74034b208588636ecc177e0dd43a7696af3
https://git.kernel.org/stable/c/88b9c4bbf83d940ab672956e5af921215905dcb4
https://git.kernel.org/stable/c/b78c114600ae3df90c083c72c290437b068577c8
https://git.kernel.org/stable/c/bf3d841ef12fcbec4458e2750956b738b043a226
https://git.kernel.org/stable/c/f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2
https://nvd.nist.gov/vuln/detail/CVE-2026-98971
https://www.cve.org/CVERecord?id=CVE-2026-98971

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0250acba81654b2ee50bde324ad72b3f0c04d0bd https://git.kernel.org/stable/c/88b9c4bbf83d940ab672956e5af921215905dcb4

Thu, 29 Oct 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-351 CWE-665

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-826
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98971.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98971 https://www.cve.org/CVERecord?id=CVE-2026-98971
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 19:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-351 CWE-665

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devm_add_action_or_reset() invokes the cleanup action immediately when registering the action fails. gpio_exar_probe() currently stores the allocated ID in exar_gpio only after registering the action, so that failure makes exar_devm_ida_free() release ID 0. If the allocated ID is nonzero, this leaks that ID and can free ID 0 belonging to another device. Store the ID before registering the cleanup action so both the immediate failure path and normal device teardown release the correct allocation.
Title		gpio: exar: initialize the ID before registering its cleanup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/01318927a9055136c207399eeb36ce07becac179 https://git.kernel.org/stable/c/4d69e74034b208588636ecc177e0dd43a7696af3 https://git.kernel.org/stable/c/b78c114600ae3df90c083c72c290437b068577c8 https://git.kernel.org/stable/c/bf3d841ef12fcbec4458e2750956b738b043a226 https://git.kernel.org/stable/c/f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:19:44.536Z

Updated: 2026-10-30T12:40:37.940Z

Reserved: 2026-09-25T10:25:14.383Z

Link: CVE-2026-98971

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:18.673

Modified: 2026-10-30T13:21:33.613

Link: CVE-2026-98971

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-98971 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T22:45:03Z

Weaknesses

CWE-826
Premature Release of Resource During Expected Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object