CVE-2026-43138

Description

A flaw was found in the Linux kernel. A local user could exploit a vulnerability in the GPIO (General Purpose Input/Output) reset controller by unbinding a dynamically created device through the sysfs (a virtual filesystem providing an interface to kernel data structures) interface. This improper handling of device unbinding can lead to a use-after-free condition, which may result in system instability or a denial of service.

Understanding the Weakness (CWE)

CWE-825

Confidentiality

Technical Impact: Read Memory

If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.

Availability

Technical Impact: DoS: Crash, Exit, or Restart

If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.

Integrity,Confidentiality,Availability

Technical Impact: Execute Unauthorized Code or Commands

If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.