---
id: CVE-2026-98971
title: 'gpio: exar: initialize the ID before registering its cleanup'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  gpio: exar: initialize the ID before registering its cleanup

  devm_add_action_or_reset() invokes the cleanup action immediately when
  registering the action fails.  gpio…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5300ebb695fa0672589ab191062392f686fca75d <
    bf3d841ef12fcbec4458e2750956b738b043a226
  - >-
    Linux >= 5300ebb695fa0672589ab191062392f686fca75d <
    b78c114600ae3df90c083c72c290437b068577c8
  - >-
    Linux >= 5300ebb695fa0672589ab191062392f686fca75d <
    01318927a9055136c207399eeb36ce07becac179
  - >-
    Linux >= 5300ebb695fa0672589ab191062392f686fca75d <
    f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2
  - >-
    Linux >= 5300ebb695fa0672589ab191062392f686fca75d <
    4d69e74034b208588636ecc177e0dd43a7696af3
  - Linux 5.11
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:19:44.536Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98971'
references:
  - url: 'https://git.kernel.org/stable/c/bf3d841ef12fcbec4458e2750956b738b043a226'
  - url: 'https://git.kernel.org/stable/c/b78c114600ae3df90c083c72c290437b068577c8'
  - url: 'https://git.kernel.org/stable/c/01318927a9055136c207399eeb36ce07becac179'
  - url: 'https://git.kernel.org/stable/c/f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2'
  - url: 'https://git.kernel.org/stable/c/4d69e74034b208588636ecc177e0dd43a7696af3'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.552Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

gpio: exar: initialize the ID before registering its cleanup

devm_add_action_or_reset() invokes the cleanup action immediately when
registering the action fails.  gpio_exar_probe() currently stores the
allocated ID in exar_gpio only after registering the action, so that
failure makes exar_devm_ida_free() release ID 0.  If the allocated ID is
nonzero, this leaks that ID and can free ID 0 belonging to another device.

Store the ID before registering the cleanup action so both the immediate
failure path and normal device teardown release the correct allocation.

## Affected

- `Linux >= 5300ebb695fa0672589ab191062392f686fca75d < bf3d841ef12fcbec4458e2750956b738b043a226`
- `Linux >= 5300ebb695fa0672589ab191062392f686fca75d < b78c114600ae3df90c083c72c290437b068577c8`
- `Linux >= 5300ebb695fa0672589ab191062392f686fca75d < 01318927a9055136c207399eeb36ce07becac179`
- `Linux >= 5300ebb695fa0672589ab191062392f686fca75d < f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2`
- `Linux >= 5300ebb695fa0672589ab191062392f686fca75d < 4d69e74034b208588636ecc177e0dd43a7696af3`
- `Linux 5.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.