CVE-2026-98528
In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we return immediately before zeroing the info struct we'll end up passing to the user-space later in lineinfo_get_v1(). This may leak the kernel stack contents. Make gpio_desc_to_lineinfo() return int so that the -ENODEV returned on failure to acquire the guard can be propagated to the callers. While not strictly necessary: move the memset() before trying to acquire the SRCU read lock too for good measure.
Affected versions
Linux kernel versions
6.9
and later are affected. Fixed in
6.12.112,
6.18.55,
7.2.9,
7.3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-98528?
CVE-2026-98528 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.9 onward and has been patched in 6.12.112, 6.18.55, 7.2.9 and others. CVE-2026-98528 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98528?
Yes. CVE-2026-98528 has been patched. Fixed versions include 6.12.112, 6.18.55, 7.2.9 and others. If you are running Linux kernel 6.9 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98528 actively exploited?
No. CVE-2026-98528 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.