CVE-2026-80563

A flaw was found in the Linux kernel's gpio: sloppy-logic-analyzer component. A local attacker with root privileges can exploit a race condition during the unbinding of a platform device. This vulnerability allows writing into memory that has already been freed, which can lead to system instability (Denial of Service) or potentially enable arbitrary code execution.

A moderate use-after-free vulnerability was found in the Linux kernel's gpio-sloppy-logic-analyzer driver. The driver creates its "trigger" debugfs file using debugfs_create_file_unsafe(), and the file's write handler does not hold a reference that keeps the per-device private data alive; that data is freed by devres when the platform device is unbound. Consequently, a local attacker with root privileges who races a write to the "trigger" debugfs file against unbinding the driver (via /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind) can cause the write handler to store data into already-freed kernel memory. This could result in a kernel panic and denial of service, and may potentially lead to arbitrary code execution. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are listed as not affected because the vulnerable code, the gpio-sloppy-logic-analyzer driver, is not present in the shipped Red Hat kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.