{"id":"CVE-2026-98971","title":"gpio: exar: initialize the ID before registering its cleanup","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: exar: initialize the ID before registering its cleanup\n\ndevm_add_action_or_reset() invokes the cleanup action immediately when\nregistering the action fails.  gpio…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 5300ebb695fa0672589ab191062392f686fca75d < bf3d841ef12fcbec4458e2750956b738b043a226","Linux >= 5300ebb695fa0672589ab191062392f686fca75d < b78c114600ae3df90c083c72c290437b068577c8","Linux >= 5300ebb695fa0672589ab191062392f686fca75d < 01318927a9055136c207399eeb36ce07becac179","Linux >= 5300ebb695fa0672589ab191062392f686fca75d < f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2","Linux >= 5300ebb695fa0672589ab191062392f686fca75d < 4d69e74034b208588636ecc177e0dd43a7696af3","Linux 5.11"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:19:44.536Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98971","references":[{"url":"https://git.kernel.org/stable/c/bf3d841ef12fcbec4458e2750956b738b043a226"},{"url":"https://git.kernel.org/stable/c/b78c114600ae3df90c083c72c290437b068577c8"},{"url":"https://git.kernel.org/stable/c/01318927a9055136c207399eeb36ce07becac179"},{"url":"https://git.kernel.org/stable/c/f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2"},{"url":"https://git.kernel.org/stable/c/4d69e74034b208588636ecc177e0dd43a7696af3"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.552Z","slug":"CVE-2026-98971","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngpio: exar: initialize the ID before registering its cleanup\n\ndevm_add_action_or_reset() invokes the cleanup action immediately when\nregistering the action fails.  gpio_exar_probe() currently stores the\nallocated ID in exar_gpio only after registering the action, so that\nfailure makes exar_devm_ida_free() release ID 0.  If the allocated ID is\nnonzero, this leaks that ID and can free ID 0 belonging to another device.\n\nStore the ID before registering the cleanup action so both the immediate\nfailure path and normal device teardown release the correct allocation.\n\n## Affected\n\n- `Linux >= 5300ebb695fa0672589ab191062392f686fca75d < bf3d841ef12fcbec4458e2750956b738b043a226`\n- `Linux >= 5300ebb695fa0672589ab191062392f686fca75d < b78c114600ae3df90c083c72c290437b068577c8`\n- `Linux >= 5300ebb695fa0672589ab191062392f686fca75d < 01318927a9055136c207399eeb36ce07becac179`\n- `Linux >= 5300ebb695fa0672589ab191062392f686fca75d < f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2`\n- `Linux >= 5300ebb695fa0672589ab191062392f686fca75d < 4d69e74034b208588636ecc177e0dd43a7696af3`\n- `Linux 5.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}