CVE-2026-64022

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64022", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.027Z", "datePublished": "2026-07-19T15:39:15.345Z", "dateUpdated": "2026-07-19T15:39:15.345Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-19T15:39:15.345Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: aggregator: remove the software node when deactivating the aggregator\n\nThe dynamic software node we create for the aggregator platform device\nwhen using configfs is leaked when the device is deactivated. Destroy it\nas the last step in the tear-down path."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpio-aggregator.c"], "versions": [{"version": "86f162e73d2d81ef6d819c06a3b6c2fda77a79b8", "lessThan": "3e657619cf7258cb53b1beaf0d02998297695cde", "status": "affected", "versionType": "git"}, {"version": "86f162e73d2d81ef6d819c06a3b6c2fda77a79b8", "lessThan": "9870ea9a4a25abef3e7af3445bfce2472528a546", "status": "affected", "versionType": "git"}, {"version": "86f162e73d2d81ef6d819c06a3b6c2fda77a79b8", "lessThan": "61fef83f239ecace1cce716135762a2d9b7b1fc6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpio-aggregator.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3e657619cf7258cb53b1beaf0d02998297695cde"}, {"url": "https://git.kernel.org/stable/c/9870ea9a4a25abef3e7af3445bfce2472528a546"}, {"url": "https://git.kernel.org/stable/c/61fef83f239ecace1cce716135762a2d9b7b1fc6"}], "title": "gpio: aggregator: remove the software node when deactivating the aggregator", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpio/gpio-aggregator.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3e657619cf7258cb53b1beaf0d02998297695cde", "status": "affected", "version": "86f162e73d2d81ef6d819c06a3b6c2fda77a79b8", "versionType": "git"}, {"lessThan": "9870ea9a4a25abef3e7af3445bfce2472528a546", "status": "affected", "version": "86f162e73d2d81ef6d819c06a3b6c2fda77a79b8", "versionType": "git"}, {"lessThan": "61fef83f239ecace1cce716135762a2d9b7b1fc6", "status": "affected", "version": "86f162e73d2d81ef6d819c06a3b6c2fda77a79b8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpio/gpio-aggregator.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2437F48D-051C-4E78-83C2-F198D0F2AE92", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: aggregator: remove the software node when deactivating the aggregator\n\nThe dynamic software node we create for the aggregator platform device\nwhen using configfs is leaked when the device is deactivated. Destroy it\nas the last step in the tear-down path."}], "id": "CVE-2026-64022", "lastModified": "2026-10-13T14:56:29.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-07-19T16:17:42.210", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3e657619cf7258cb53b1beaf0d02998297695cde"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/61fef83f239ecace1cce716135762a2d9b7b1fc6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9870ea9a4a25abef3e7af3445bfce2472528a546"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: gpio: aggregator: remove the software node when deactivating the aggregator", "id": "2502398", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502398"}, "csaw": false, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngpio: aggregator: remove the software node when deactivating the aggregator\nThe dynamic software node we create for the aggregator platform device\nwhen using configfs is leaked when the device is deactivated. Destroy it\nas the last step in the tear-down path.", "A flaw was found in the Linux kernel's GPIO (General Purpose Input/Output) aggregator component. When the aggregator device is deactivated after being configured using configfs, a dynamic software node is not properly removed. This oversight leads to a resource leak, which could potentially be exploited by a local attacker to cause a Denial of Service (DoS) by exhausting system resources."], "name": "CVE-2026-64022", "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64022\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64022\nhttps://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-64022-1155@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86f162e73d2d81ef6d819c06a3b6c2fda77a79b8,3e657619cf7258cb53b1beaf0d02998297695cde)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86f162e73d2d81ef6d819c06a3b6c2fda77a79b8,9870ea9a4a25abef3e7af3445bfce2472528a546)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[86f162e73d2d81ef6d819c06a3b6c2fda77a79b8,61fef83f239ecace1cce716135762a2d9b7b1fc6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.34,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T17:00:04.077695+00:00", "updated": "2026-10-17T10:00:08.627074+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}