CVE-2026-98971
kernel: gpio: exar: initialize the ID before registering its cleanup
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 23, 2026
Updated · October 29, 2026
Description
A flaw was found in the Linux kernel's Exar GPIO (General Purpose Input/Output) driver. A local user could cause a Denial of Service (DoS) when device initialization error handling triggers cleanup before the newly allocated device identifier is saved. Because the identifier is not yet stored, the driver erroneously releases identifier zero, potentially freeing a resource belonging to another active device and leading to system instability.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.1CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-826 · Premature Release of Resource During Expected Lifetime