Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-99050— gpio: mpsse: fix race when arming the IRQ poll worker

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： gpio: mpsse：修复在启用 IRQ 轮询工作线程时的竞态条件在将轮询工作线程发布到工作队列之前，就调用了来启动该工作线程。这导致工作线程在尚未被添加到列表时就开始执行。如果此时遍历该列表，将会遗漏该工作线程。当函数返回后，USB 核心会释放结构体，而孤立的工作线程仍在访问该已释放的内存，从而引发“释放后使用”（use-after-free）漏洞。修复方法是将“发布”和“启动”工作线程的操作合并到同一个自旋锁临界区中执行。在设备拆除（teardo

CVSS 7.8 · High EPSS 0.21% · P10 Updated Oct 24, 2026

Possible ATT&CK Techniques 1 AI

T1069 · Permission Groups Discovery

Affected Version Matrix 9

Vendor	Product	Version Range	Status
Linux	Linux	`472d900c8bcac301ae0e40fdca7db799bd989ff5< 76390ac0bca7e5058b7482eb4d951c3bda5df812`	affected
		`179ef1127d7a4f09f0e741fa9f30b8a8e7886271< c0071ee496e1228976c72b096f529503222708a0`	affected
		`179ef1127d7a4f09f0e741fa9f30b8a8e7886271< 7efa1a1953cd6b20b23a3524d5b4b81789c6ef25`	affected
		`6.18.6< 6.18.57`	affected
		`6.19`	affected
		`< 6.19`	unaffected
		`6.18.57≤ 6.18.*`	unaffected
		`7.2.11≤ 7.2.*`	unaffected
… +1 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

gpio: mpsse: fix race when arming the IRQ poll worker

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_enable() arms the poll worker before publishing it: schedule_work() runs before the worker is added to priv->workers. If gpio_mpsse_disconnect() walks the list in that window it misses the worker, and once disconnect returns, the USB core frees mpsse_priv while the orphaned gpio_mpsse_poll() work keeps accessing it, causing a use-after-free. Fix this by publishing and arming the worker in one irq_spin critical section. Teardown walks the same list under irq_spin, so a worker found on the list is guaranteed to be armed, and cancel_work_sync() handles it whether it is queued or running. A worker armed after the disconnect walk would still be missed, so also set a new priv->dying flag under irq_spin before the teardown walk, and check it in the same critical section, freeing it via kfree_rcu() instead when the device is going away, since kfree() would be called with the IRQ core's raw spinlock held and may sleep on PREEMPT_RT. schedule_work() is safe to call with irq_spin held, and the next probe gets a fresh mpsse_priv, so the flag never needs to be cleared. This issue was found by an in-house static analysis tool.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	472d900c8bcac301ae0e40fdca7db799bd989ff5 ~ 76390ac0bca7e5058b7482eb4d951c3bda5df812	-
Linux	Linux	6.19	-

II. Public POCs for CVE-2026-99050

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99050

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99050 (3)

https://www.cve.org/CVERecord?id=CVE-2026-99050

Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total

CVE-2026-98959	9.8 CRITICAL	btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99079	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-99078	9.8 CRITICAL	net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-98870	8.8 HIGH	ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980	8.8 HIGH	namei: don't reveal overmounted entries in refwalk
CVE-2026-99083	8.8 HIGH	ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082	8.8 HIGH	KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98981	8.8 HIGH	namespace: unhash a dentry before detaching the mounts on it
CVE-2026-98988	8.8 HIGH	namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98978	8.4 HIGH	namespace: never expire a locked mount
CVE-2026-99042	8.4 HIGH	io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-99064	8.1 HIGH	cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968	8.1 HIGH	amt: send the relay's General Query directly from the receive path
CVE-2026-99053	7.8 HIGH	tipc: hold a reference to nodes found by link name
CVE-2026-98889	7.8 HIGH	wifi: iwlwifi: mvm: fix sched scan IE sizing
CVE-2026-99051	7.8 HIGH	fsverity: RCU-delay the freeing of struct fsverity_info
CVE-2026-98974	7.8 HIGH	xfs: fix exchange-range-to-eof file size exchange
CVE-2026-98999	7.8 HIGH	drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
CVE-2026-99056	7.8 HIGH	strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-98976	7.8 HIGH	namespace: keep the lock on a mount that a propagated copy is moved beneath

Showing top 20 of 218 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux