gpio: exar: initialize the ID before registering its cleanup
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.12.113, 6.18.57, 7.2.11
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's GPIO driver for Exar devices contains a flaw in its initialization order. A failed resource registration could cause the driver to release the wrong device ID, potentially leaking an ID or freeing one that belongs to another device.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devm_add_action_or_reset() invokes the cleanup action immediately when registering the action fails. gpio_exar_probe() currently stores the allocated ID in exar_gpio only after registering the action, so that failure makes exar_devm_ida_free() release ID 0. If the allocated ID is nonzero, this leaks that ID and can free ID 0 belonging to another device. Store the ID before registering the cleanup action so both the immediate failure path and normal device teardown release the correct allocation.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Linux Linux
From 5300ebb695fa0672589ab191062392f686fca75d · fixed in bf3d841ef12fcbec4458e2750956b738b043a226; From 5300ebb695fa0672589ab191062392f686fca75d · fixed in b78c114600ae3df90c083c72c290437b068577c8; From 5300ebb695fa0672589ab191062392f686fca75d · fixed in 01318927a9055136c207399eeb36ce07becac179; From 5300ebb695fa0672589ab191062392f686fca75d · fixed in f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2; From 5300ebb695fa0672589ab191062392f686fca75d · fixed in 4d69e74034b208588636ecc177e0dd43a7696af3
- Linux Linux
5.11
- KernelLinux
From 5.11.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.113; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.2.11