CVE-2026-99162

A flaw was found in the Linux kernel's General Purpose Input/Output (GPIO) subsystem. A use-after-free vulnerability occurs when adding shared proxies because a lookup table can outlive the device object whose name string is referenced. A local attacker could exploit this flaw to cause memory corruption, leading to a system crash and Denial of Service (DoS).

This vulnerability is rated as having Moderate severity because exploitation requires local access to trigger shared GPIO device registration and removal, and the blast radius is limited to a denial of service via a kernel crash. GPIO subsystem shared proxies are primarily relevant to embedded and specialized hardware platforms rather than typical enterprise cloud and server deployments. In standard Red Hat environments, unprivileged users do not have direct access to manipulate the device objects necessary to trigger this condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.