CVE-2026-64022

kernel: gpio: aggregator: remove the software node when deactivating the aggregator

Loading…

Severity

Unknown

Red Hat Product Security

—

CVSS

Review impact separately from score.

Published · July 19, 2026

Updated · August 7, 2026

Description

A flaw was found in the Linux kernel's GPIO (General Purpose Input/Output) aggregator component. When the aggregator device is deactivated after being configured using configfs, a dynamic software node is not properly removed. This oversight leads to a resource leak, which could potentially be exploited by a local attacker to cause a Denial of Service (DoS) by exhausting system resources.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CWE-772 · Missing Release of Resource after Effective Lifetime