CVE-2026-98528

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98528", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.355Z", "datePublished": "2026-10-18T15:17:46.695Z", "dateUpdated": "2026-10-19T09:21:10.272Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:21:10.272Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: cdev: fix kernel stack leak to user-space in error path\n\nIf we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we\nreturn immediately before zeroing the info struct we'll end up passing\nto the user-space later in lineinfo_get_v1(). This may leak the kernel\nstack contents. Make gpio_desc_to_lineinfo() return int so that the\n-ENODEV returned on failure to acquire the guard can be propagated to\nthe callers.\n\nWhile not strictly necessary: move the memset() before trying to acquire\nthe SRCU read lock too for good measure."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpiolib-cdev.c"], "versions": [{"version": "d83cee3d2bb131c7fca7e19f1e33dc7530fd7083", "lessThan": "8460ee5216ab9a38263b01dca4b0a27e083f70f3", "status": "affected", "versionType": "git"}, {"version": "d83cee3d2bb131c7fca7e19f1e33dc7530fd7083", "lessThan": "cf3d043582e106a0e57002bec8a6de8929ba3e1c", "status": "affected", "versionType": "git"}, {"version": "d83cee3d2bb131c7fca7e19f1e33dc7530fd7083", "lessThan": "60a466f231905cd96ae6f0f3c44a710c97873dac", "status": "affected", "versionType": "git"}, {"version": "d83cee3d2bb131c7fca7e19f1e33dc7530fd7083", "lessThan": "1feb5d39b05afd902ed9fc902ec5b15be03a4bdb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpiolib-cdev.c"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8460ee5216ab9a38263b01dca4b0a27e083f70f3"}, {"url": "https://git.kernel.org/stable/c/cf3d043582e106a0e57002bec8a6de8929ba3e1c"}, {"url": "https://git.kernel.org/stable/c/60a466f231905cd96ae6f0f3c44a710c97873dac"}, {"url": "https://git.kernel.org/stable/c/1feb5d39b05afd902ed9fc902ec5b15be03a4bdb"}], "title": "gpio: cdev: fix kernel stack leak to user-space in error path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpio/gpiolib-cdev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8460ee5216ab9a38263b01dca4b0a27e083f70f3", "status": "affected", "version": "d83cee3d2bb131c7fca7e19f1e33dc7530fd7083", "versionType": "git"}, {"lessThan": "cf3d043582e106a0e57002bec8a6de8929ba3e1c", "status": "affected", "version": "d83cee3d2bb131c7fca7e19f1e33dc7530fd7083", "versionType": "git"}, {"lessThan": "60a466f231905cd96ae6f0f3c44a710c97873dac", "status": "affected", "version": "d83cee3d2bb131c7fca7e19f1e33dc7530fd7083", "versionType": "git"}, {"lessThan": "1feb5d39b05afd902ed9fc902ec5b15be03a4bdb", "status": "affected", "version": "d83cee3d2bb131c7fca7e19f1e33dc7530fd7083", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpio/gpiolib-cdev.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: cdev: fix kernel stack leak to user-space in error path\n\nIf we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we\nreturn immediately before zeroing the info struct we'll end up passing\nto the user-space later in lineinfo_get_v1(). This may leak the kernel\nstack contents. Make gpio_desc_to_lineinfo() return int so that the\n-ENODEV returned on failure to acquire the guard can be propagated to\nthe callers.\n\nWhile not strictly necessary: move the memset() before trying to acquire\nthe SRCU read lock too for good measure."}], "id": "CVE-2026-98528", "lastModified": "2026-10-19T10:19:08.137", "metrics": {}, "published": "2026-10-18T16:17:04.303", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1feb5d39b05afd902ed9fc902ec5b15be03a4bdb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/60a466f231905cd96ae6f0f3c44a710c97873dac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8460ee5216ab9a38263b01dca4b0a27e083f70f3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cf3d043582e106a0e57002bec8a6de8929ba3e1c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: gpio: cdev: fix kernel stack leak to user-space in error path", "id": "2555004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555004"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-908", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngpio: cdev: fix kernel stack leak to user-space in error path\nIf we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we\nreturn immediately before zeroing the info struct we'll end up passing\nto the user-space later in lineinfo_get_v1(). This may leak the kernel\nstack contents. Make gpio_desc_to_lineinfo() return int so that the\n-ENODEV returned on failure to acquire the guard can be propagated to\nthe callers.\nWhile not strictly necessary: move the memset() before trying to acquire\nthe SRCU read lock too for good measure.", "A flaw was found in the Linux kernel's GPIO (General Purpose Input/Output) character device interface. This vulnerability allows a local user to cause an information disclosure of sensitive kernel stack data. When an error occurs while querying GPIO line details, the kernel fails to clear the data structure before passing it back to user space, leaking uninitialized kernel memory contents."], "name": "CVE-2026-98528", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98528\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98528\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98528.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d83cee3d2bb131c7fca7e19f1e33dc7530fd7083,8460ee5216ab9a38263b01dca4b0a27e083f70f3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d83cee3d2bb131c7fca7e19f1e33dc7530fd7083,cf3d043582e106a0e57002bec8a6de8929ba3e1c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d83cee3d2bb131c7fca7e19f1e33dc7530fd7083,60a466f231905cd96ae6f0f3c44a710c97873dac)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d83cee3d2bb131c7fca7e19f1e33dc7530fd7083,1feb5d39b05afd902ed9fc902ec5b15be03a4bdb)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.9,6.9]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T17:30:16.960346+00:00", "updated": "2026-10-20T20:00:15.872805+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}