Description
In the Linux kernel, the following vulnerability has been resolved:

gpio: mpsse: fix race when arming the IRQ poll worker

gpio_mpsse_irq_enable() arms the poll worker before publishing it:
schedule_work() runs before the worker is added to priv->workers. If
gpio_mpsse_disconnect() walks the list in that window it misses the
worker, and once disconnect returns, the USB core frees mpsse_priv
while the orphaned gpio_mpsse_poll() work keeps accessing it, causing
a use-after-free.

Fix this by publishing and arming the worker in one irq_spin
critical section. Teardown walks the same list under irq_spin, so a
worker found on the list is guaranteed to be armed, and
cancel_work_sync() handles it whether it is queued or running.

A worker armed after the disconnect walk would still be missed, so
also set a new priv->dying flag under irq_spin before the teardown
walk, and check it in the same critical section, freeing it via
kfree_rcu() instead when the device is going away, since kfree()
would be called with the IRQ core's raw spinlock held and may sleep
on PREEMPT_RT. schedule_work() is safe to call with irq_spin held,
and the next probe gets a fresh mpsse_priv, so the flag never needs
to be cleared.

This issue was found by an in-house static analysis tool.
Published: 2026-10-23
Score: n/a
EPSS: n/a
KEV: No
Impact: Use–After–Free leading to potential kernel crash or privilege escalation
Action: Immediate Patch
AI Analysis

Impact

The flaw arises from a race condition in the MPSSE GPIO driver where a poll worker is armed before being properly added to the driver's worker list. During device disconnection, the disconnected path walks the worker list while the worker may still run, allowing the worker to access memory that has already been freed. This use‑after‑free can corrupt kernel memory, crash the system, or be leveraged by an attacker with local execution capability to gain higher privileges.

Affected Systems

The issue exists in the Linux kernel MPSSE GPIO driver. Any standard Linux kernel that did not incorporate the defensive changes in the referenced commit is potentially affected. Because the driver is bundled with the mainline kernel, all typical installations running an unpatched kernel are at risk.

Risk and Exploitability

The vulnerability is exploitable from local code, as an attacker would need to trigger the disconnect sequence while the orphaned worker continues to run. No EPSS score is available, and the entry is not listed in the CISA KEV catalog, but the absence of these metrics does not diminish the severity of a classic use‑after‑free. An attacker with local access can use this flaw to corrupt kernel data or execute arbitrary code in kernel mode, implying high risk.

Generated by OpenCVE AI on October 23, 2026 at 15:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the system kernel to a release that incorporates commit 76390ac0bca7e5058b7482eb4d951c3bda5df812 or later.
  • If using a custom kernel, apply the patch from the referenced commit to the MPSSE GPIO driver source.
  • As a temporary precaution, disable the MPSSE driver or block USB connections that may trigger the driver until the kernel has been updated.

Generated by OpenCVE AI on October 23, 2026 at 15:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Fri, 23 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_enable() arms the poll worker before publishing it: schedule_work() runs before the worker is added to priv->workers. If gpio_mpsse_disconnect() walks the list in that window it misses the worker, and once disconnect returns, the USB core frees mpsse_priv while the orphaned gpio_mpsse_poll() work keeps accessing it, causing a use-after-free. Fix this by publishing and arming the worker in one irq_spin critical section. Teardown walks the same list under irq_spin, so a worker found on the list is guaranteed to be armed, and cancel_work_sync() handles it whether it is queued or running. A worker armed after the disconnect walk would still be missed, so also set a new priv->dying flag under irq_spin before the teardown walk, and check it in the same critical section, freeing it via kfree_rcu() instead when the device is going away, since kfree() would be called with the IRQ core's raw spinlock held and may sleep on PREEMPT_RT. schedule_work() is safe to call with irq_spin held, and the next probe gets a fresh mpsse_priv, so the flag never needs to be cleared. This issue was found by an in-house static analysis tool.
Title gpio: mpsse: fix race when arming the IRQ poll worker
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-23T12:22:29.204Z

Reserved: 2026-09-25T10:25:14.388Z

Link: CVE-2026-99050

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T13:17:28.513

Modified: 2026-10-23T13:17:28.513

Link: CVE-2026-99050

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T16:00:18Z

Weaknesses