CVE-2026-43181

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43181", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.991Z", "datePublished": "2026-05-06T11:27:53.626Z", "dateUpdated": "2026-05-11T22:19:24.836Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:19:24.836Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: sysfs: fix chip removal with GPIOs exported over sysfs\n\nCurrently if we export a GPIO over sysfs and unbind the parent GPIO\ncontroller, the exported attribute will remain under /sys/class/gpio\nbecause once we remove the parent device, we can no longer associate the\ndescriptor with it in gpiod_unexport() and never drop the final\nreference.\n\nRework the teardown code: provide an unlocked variant of\ngpiod_unexport() and remove all exported GPIOs with the sysfs_lock taken\nbefore unregistering the parent device itself. This is done to prevent\nany new exports happening before we unregister the device completely."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpiolib-sysfs.c"], "versions": [{"version": "1cd53df733c21ae0d344a2dec941a3e2a06fefd9", "lessThan": "54f463494eb5bf193ef7d904a493474c451734df", "status": "affected", "versionType": "git"}, {"version": "1cd53df733c21ae0d344a2dec941a3e2a06fefd9", "lessThan": "a645cc25904b0baf508b77a0402ce151212b9800", "status": "affected", "versionType": "git"}, {"version": "1cd53df733c21ae0d344a2dec941a3e2a06fefd9", "lessThan": "6766f59012301f1bf3f46c6e7149caca45d92309", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpiolib-sysfs.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/54f463494eb5bf193ef7d904a493474c451734df"}, {"url": "https://git.kernel.org/stable/c/a645cc25904b0baf508b77a0402ce151212b9800"}, {"url": "https://git.kernel.org/stable/c/6766f59012301f1bf3f46c6e7149caca45d92309"}], "title": "gpio: sysfs: fix chip removal with GPIOs exported over sysfs", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpio/gpiolib-sysfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "54f463494eb5bf193ef7d904a493474c451734df", "status": "affected", "version": "1cd53df733c21ae0d344a2dec941a3e2a06fefd9", "versionType": "git"}, {"lessThan": "a645cc25904b0baf508b77a0402ce151212b9800", "status": "affected", "version": "1cd53df733c21ae0d344a2dec941a3e2a06fefd9", "versionType": "git"}, {"lessThan": "6766f59012301f1bf3f46c6e7149caca45d92309", "status": "affected", "version": "1cd53df733c21ae0d344a2dec941a3e2a06fefd9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpio/gpiolib-sysfs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "742E05BA-773A-4EF3-822F-A4A7DED31A65", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: sysfs: fix chip removal with GPIOs exported over sysfs\n\nCurrently if we export a GPIO over sysfs and unbind the parent GPIO\ncontroller, the exported attribute will remain under /sys/class/gpio\nbecause once we remove the parent device, we can no longer associate the\ndescriptor with it in gpiod_unexport() and never drop the final\nreference.\n\nRework the teardown code: provide an unlocked variant of\ngpiod_unexport() and remove all exported GPIOs with the sysfs_lock taken\nbefore unregistering the parent device itself. This is done to prevent\nany new exports happening before we unregister the device completely."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngpio: sysfs: corregir la eliminaci\u00f3n del chip con GPIOs exportados a trav\u00e9s de sysfs\n\nActualmente, si exportamos un GPIO a trav\u00e9s de sysfs y desvinculamos el controlador GPIO padre, el atributo exportado permanecer\u00e1 bajo /sys/class/gpio porque una vez que eliminamos el dispositivo padre, ya no podemos asociar el descriptor con \u00e9l en gpiod_unexport() y nunca se elimina la referencia final.\n\nReestructurar el c\u00f3digo de desmontaje: proporcionar una variante desbloqueada de gpiod_unexport() y eliminar todos los GPIOs exportados con el sysfs_lock tomado antes de desregistrar el propio dispositivo padre. Esto se hace para evitar que ocurran nuevas exportaciones antes de que desregistremos el dispositivo por completo."}], "id": "CVE-2026-43181", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-06T12:16:36.670", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/54f463494eb5bf193ef7d904a493474c451734df"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6766f59012301f1bf3f46c6e7149caca45d92309"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a645cc25904b0baf508b77a0402ce151212b9800"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: gpio: sysfs: fix chip removal with GPIOs exported over sysfs", "id": "2467068", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467068"}, "csaw": false, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's GPIO (General Purpose Input/Output) and sysfs subsystems. When a GPIO is exported through sysfs and its parent controller is removed, the system fails to properly unexport the GPIO attribute. This oversight prevents the final reference to the GPIO descriptor from being dropped, leading to a resource leak. Repeated exploitation of this flaw could result in resource exhaustion, potentially causing a Denial of Service (DoS) condition."], "name": "CVE-2026-43181", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43181\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43181\nhttps://lore.kernel.org/linux-cve-announce/2026050639-CVE-2026-43181-2c8c@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1cd53df733c21ae0d344a2dec941a3e2a06fefd9,54f463494eb5bf193ef7d904a493474c451734df)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1cd53df733c21ae0d344a2dec941a3e2a06fefd9,a645cc25904b0baf508b77a0402ce151212b9800)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1cd53df733c21ae0d344a2dec941a3e2a06fefd9,6766f59012301f1bf3f46c6e7149caca45d92309)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.16,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.6,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T16:15:06.732905+00:00", "updated": "2026-05-12T00:00:04.184441+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}