CVE-2026-99162

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99162", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.397Z", "datePublished": "2026-10-28T10:35:14.755Z", "dateUpdated": "2026-10-28T10:35:14.755Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-28T10:35:14.755Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: shared: fix use-after-free bug when adding shared proxies\n\nThe GPIO lookup table can stay alive for longer than the kobject whose\nname string's address we're assigning to lookup->dev_id. Fix a potential\nUAF by duplicating the string."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpiolib-shared.c"], "versions": [{"version": "a060b8c511abb0997381b397e52149a5e3e5259a", "lessThan": "8861491f8501516429e0e6c9d7a056480047227c", "status": "affected", "versionType": "git"}, {"version": "a060b8c511abb0997381b397e52149a5e3e5259a", "lessThan": "bd22f7e63509fa758cf500d9af3e88a3d3df96be", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpiolib-shared.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8861491f8501516429e0e6c9d7a056480047227c"}, {"url": "https://git.kernel.org/stable/c/bd22f7e63509fa758cf500d9af3e88a3d3df96be"}], "title": "gpio: shared: fix use-after-free bug when adding shared proxies", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpio/gpiolib-shared.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8861491f8501516429e0e6c9d7a056480047227c", "status": "affected", "version": "a060b8c511abb0997381b397e52149a5e3e5259a", "versionType": "git"}, {"lessThan": "bd22f7e63509fa758cf500d9af3e88a3d3df96be", "status": "affected", "version": "a060b8c511abb0997381b397e52149a5e3e5259a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpio/gpiolib-shared.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: shared: fix use-after-free bug when adding shared proxies\n\nThe GPIO lookup table can stay alive for longer than the kobject whose\nname string's address we're assigning to lookup->dev_id. Fix a potential\nUAF by duplicating the string."}], "id": "CVE-2026-99162", "lastModified": "2026-10-28T11:17:36.500", "metrics": {}, "published": "2026-10-28T11:17:36.500", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8861491f8501516429e0e6c9d7a056480047227c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bd22f7e63509fa758cf500d9af3e88a3d3df96be"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via use-after-free in GPIO subsystem", "id": "2562741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562741"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngpio: shared: fix use-after-free bug when adding shared proxies\nThe GPIO lookup table can stay alive for longer than the kobject whose\nname string's address we're assigning to lookup->dev_id. Fix a potential\nUAF by duplicating the string.", "A flaw was found in the Linux kernel's General Purpose Input/Output (GPIO) subsystem. A use-after-free vulnerability occurs when adding shared proxies because a lookup table can outlive the device object whose name string is referenced. A local attacker could exploit this flaw to cause memory corruption, leading to a system crash and Denial of Service (DoS)."], "name": "CVE-2026-99162", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T10:35:14Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99162\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99162\nhttps://git.kernel.org/stable/c/8861491f8501516429e0e6c9d7a056480047227c\nhttps://git.kernel.org/stable/c/bd22f7e63509fa758cf500d9af3e88a3d3df96be"], "statement": "This vulnerability is rated as having Moderate severity because exploitation requires local access to trigger shared GPIO device registration and removal, and the blast radius is limited to a denial of service via a kernel crash. GPIO subsystem shared proxies are primarily relevant to embedded and specialized hardware platforms rather than typical enterprise cloud and server deployments. In standard Red Hat environments, unprivileged users do not have direct access to manipulate the device objects necessary to trigger this condition.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a060b8c511abb0997381b397e52149a5e3e5259a,8861491f8501516429e0e6c9d7a056480047227c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a060b8c511abb0997381b397e52149a5e3e5259a,bd22f7e63509fa758cf500d9af3e88a3d3df96be)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.19,6.19]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a060b8c511abb0997381b397e52149a5e3e5259a,8861491f8501516429e0e6c9d7a056480047227c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a060b8c511abb0997381b397e52149a5e3e5259a,bd22f7e63509fa758cf500d9af3e88a3d3df96be)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.19,6.19]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T14:00:17.409500+00:00", "updated": "2026-11-02T04:00:09.333702+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}