In the Linux kernel, the following vulnerability has been resolved:

gpio: exar: initialize the ID before registering its cleanup

devm_add_action_or_reset() invokes the cleanup action immediately when
registering the action fails. gpio_exar_probe() currently stores the
allocated ID in exar_gpio only after registering the action, so that
failure makes exar_devm_ida_free() release ID 0. If the allocated ID is
nonzero, this leaks that ID and can free ID 0 belonging to another device.

Store the ID before registering the cleanup action so both the immediate
failure path and normal device teardown release the correct allocation.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
5300ebb695fa0672589ab191062392f686fca75d affected < bf3d841ef12fcbec4458e2750956b738b043a226
5300ebb695fa0672589ab191062392f686fca75d affected < b78c114600ae3df90c083c72c290437b068577c8
5300ebb695fa0672589ab191062392f686fca75d affected < 01318927a9055136c207399eeb36ce07becac179
5300ebb695fa0672589ab191062392f686fca75d affected < f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2
5300ebb695fa0672589ab191062392f686fca75d affected < 4d69e74034b208588636ecc177e0dd43a7696af3
Linux Linux affected
Version Status Constraints
5.11 affected —
0 unaffected < 5.11
6.6.160 unaffected ≤ 6.6.*
6.12.113 unaffected ≤ 6.12.*
6.18.57 unaffected ≤ 6.18.*
7.2.11 unaffected ≤ 7.2.*
7.3 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/01318927a9055136c207399eeb36ce07becac179 cve-icon cve-icon
https://git.kernel.org/stable/c/4d69e74034b208588636ecc177e0dd43a7696af3 cve-icon cve-icon
https://git.kernel.org/stable/c/b78c114600ae3df90c083c72c290437b068577c8 cve-icon cve-icon
https://git.kernel.org/stable/c/bf3d841ef12fcbec4458e2750956b738b043a226 cve-icon cve-icon
https://git.kernel.org/stable/c/f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2 cve-icon cve-icon
History

Fri, 23 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-351
CWE-665

Fri, 23 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devm_add_action_or_reset() invokes the cleanup action immediately when registering the action fails. gpio_exar_probe() currently stores the allocated ID in exar_gpio only after registering the action, so that failure makes exar_devm_ida_free() release ID 0. If the allocated ID is nonzero, this leaks that ID and can free ID 0 belonging to another device. Store the ID before registering the cleanup action so both the immediate failure path and normal device teardown release the correct allocation.
Title gpio: exar: initialize the ID before registering its cleanup
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-23T12:19:44.536Z

Reserved: 2026-09-25T10:25:14.383Z

Link: CVE-2026-98971

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T13:17:18.673

Modified: 2026-10-23T13:17:18.673

Link: CVE-2026-98971

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T17:00:15Z

Weaknesses