SB20260507203 - Use-after-free in Linux kernel reset driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-43138)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the gpio reset device sysfs bind and unbind handling when processing sysfs bind or unbind operations. A local user can unbind the device while a reset control handle is in use to cause a denial of service.

The issue affects a dynamically created device that is intended to remain in memory, and exploitation requires user-space access to the relevant sysfs interface.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/09d6efc6abd42809956d598906c222ccd1c8ae92
• https://git.kernel.org/stable/c/16de4c6a8fe9ff497ca1aba33ef0dbee09f11952
• https://git.kernel.org/stable/c/1d7d869f074f98c34fe23f6a56e5f3acc1f95a2b
• https://git.kernel.org/stable/c/76801c3dfca0ac6339a23e9615b5f23e25b8644c