SB2026082774 - Use-after-free in Linux kernel gpio driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-80563)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a use-after-free in the trigger debugfs write handler in drivers/gpio/gpio-sloppy-logic-analyzer.c when writing to the "trigger" debugfs file during device unbind. A local user can write to the debugfs interface while racing an unbind operation to cause memory corruption.

The race is reachable via /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/23e9f32c0c7d2043e39655cff5ee3ddf29a43f80
• https://git.kernel.org/stable/c/24bef4918f6ab806260476e2f93d8f791fd17449
• https://git.kernel.org/stable/c/44f3468a0aef1aabdad551898ab7cfa2a9d20e99
• https://git.kernel.org/stable/c/49a1ebb1ef2c8ada300c174b65273810abb4e326