Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98971— gpio: exar: initialize the ID before registering its cleanup

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： gpio: exar：在注册清理动作之前初始化 ID 当注册动作失败时， 会立即执行清理动作。目前， 只有在注册动作之后才将分配的 ID 存入 中，因此一旦注册失败， 就会释放 ID 0。如果实际分配的 ID 非零，这将导致该 ID 发生泄漏，并可能错误地释放属于其他设备的 ID 0。 应在注册清理动作之前先存储 ID，以确保在立即失败路径和正常的设备拆除过程中都能正确释放所分配的资源。

AI Predicted 5.5 Difficulty: Hard

Possible ATT&CK Techniques 1 AI

T1069.002 · Domain Groups

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 5300ebb695fa0672589ab191062392f686fca75d< bf3d841ef12fcbec4458e2750956b738b043a226 affected
5300ebb695fa0672589ab191062392f686fca75d< b78c114600ae3df90c083c72c290437b068577c8 affected
5300ebb695fa0672589ab191062392f686fca75d< 01318927a9055136c207399eeb36ce07becac179 affected
5300ebb695fa0672589ab191062392f686fca75d< f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2 affected
5300ebb695fa0672589ab191062392f686fca75d< 4d69e74034b208588636ecc177e0dd43a7696af3 affected
5.11 affected
< 5.11 unaffected
6.6.160≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98971

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
gpio: exar: initialize the ID before registering its cleanup
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devm_add_action_or_reset() invokes the cleanup action immediately when registering the action fails. gpio_exar_probe() currently stores the allocated ID in exar_gpio only after registering the action, so that failure makes exar_devm_ida_free() release ID 0. If the allocated ID is nonzero, this leaks that ID and can free ID 0 belonging to another device. Store the ID before registering the cleanup action so both the immediate failure path and normal device teardown release the correct allocation.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5300ebb695fa0672589ab191062392f686fca75d ~ bf3d841ef12fcbec4458e2750956b738b043a226 -
Linux Linux 5.11 -

II. Public POCs for CVE-2026-98971

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98971

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98971 (4)

Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total

CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-99054 7.8 HIGH tipc: destroy topsrv workqueues before closing connections
CVE-2026-98944 7.8 HIGH HID: steam: Refactor registration
CVE-2026-99050 7.8 HIGH gpio: mpsse: fix race when arming the IRQ poll worker
CVE-2026-99051 7.8 HIGH fsverity: RCU-delay the freeing of struct fsverity_info
CVE-2026-99053 7.8 HIGH tipc: hold a reference to nodes found by link name
CVE-2026-99056 7.8 HIGH strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-99016 7.8 HIGH riscv: futex: untag the user pointer before the atomic access

Showing top 20 of 218 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98971

No comments yet

Leave a comment