{"id":"CVE-2026-99050","title":"gpio: mpsse: fix race when arming the IRQ poll worker","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mpsse: fix race when arming the IRQ poll worker\n\ngpio_mpsse_irq_enable() arms the poll worker before publishing it:\nschedule_work() runs before the worker is adde…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 472d900c8bcac301ae0e40fdca7db799bd989ff5 < 76390ac0bca7e5058b7482eb4d951c3bda5df812","Linux >= 179ef1127d7a4f09f0e741fa9f30b8a8e7886271 < c0071ee496e1228976c72b096f529503222708a0","Linux >= 179ef1127d7a4f09f0e741fa9f30b8a8e7886271 < 7efa1a1953cd6b20b23a3524d5b4b81789c6ef25","Linux >= 6.18.6 < 6.18.57","Linux 6.19"],"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T12:22:29.204Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99050","references":[{"url":"https://git.kernel.org/stable/c/76390ac0bca7e5058b7482eb4d951c3bda5df812"},{"url":"https://git.kernel.org/stable/c/c0071ee496e1228976c72b096f529503222708a0"},{"url":"https://git.kernel.org/stable/c/7efa1a1953cd6b20b23a3524d5b4b81789c6ef25"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T13:24:55.525Z","slug":"CVE-2026-99050","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mpsse: fix race when arming the IRQ poll worker\n\ngpio_mpsse_irq_enable() arms the poll worker before publishing it:\nschedule_work() runs before the worker is added to priv->workers. If\ngpio_mpsse_disconnect() walks the list in that window it misses the\nworker, and once disconnect returns, the USB core frees mpsse_priv\nwhile the orphaned gpio_mpsse_poll() work keeps accessing it, causing\na use-after-free.\n\nFix this by publishing and arming the worker in one irq_spin\ncritical section. Teardown walks the same list under irq_spin, so a\nworker found on the list is guaranteed to be armed, and\ncancel_work_sync() handles it whether it is queued or running.\n\nA worker armed after the disconnect walk would still be missed, so\nalso set a new priv->dying flag under irq_spin before the teardown\nwalk, and check it in the same critical section, freeing it via\nkfree_rcu() instead when the device is going away, since kfree()\nwould be called with the IRQ core's raw spinlock held and may sleep\non PREEMPT_RT. schedule_work() is safe to call with irq_spin held,\nand the next probe gets a fresh mpsse_priv, so the flag never needs\nto be cleared.\n\nThis issue was found by an in-house static analysis tool.\n\n## Affected\n\n- `Linux >= 472d900c8bcac301ae0e40fdca7db799bd989ff5 < 76390ac0bca7e5058b7482eb4d951c3bda5df812`\n- `Linux >= 179ef1127d7a4f09f0e741fa9f30b8a8e7886271 < c0071ee496e1228976c72b096f529503222708a0`\n- `Linux >= 179ef1127d7a4f09f0e741fa9f30b8a8e7886271 < 7efa1a1953cd6b20b23a3524d5b4b81789c6ef25`\n- `Linux >= 6.18.6 < 6.18.57`\n- `Linux 6.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}