SB20260507168 - Improper resource shutdown or release in Linux kernel gpio driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-43181)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the gpio sysfs export handling when removing or unbinding a parent GPIO controller with GPIOs exported over sysfs. A local user can export a GPIO over sysfs and unbind the parent GPIO controller to cause a denial of service.

The issue can leave stale exported attributes under /sys/class/gpio and prevent the final reference from being dropped.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/54f463494eb5bf193ef7d904a493474c451734df
• https://git.kernel.org/stable/c/6766f59012301f1bf3f46c6e7149caca45d92309
• https://git.kernel.org/stable/c/a645cc25904b0baf508b77a0402ce151212b9800