Use-After-Free Vulnerability in Linux Kernel GPIO Character Device

CVE-2025-40249

What is CVE-2025-40249?

A use-after-free vulnerability exists in the GPIO character device interface of the Linux kernel. Due to a flaw in the handling of the reference count for file descriptors, a situation may arise where the user-space is notified of a GPIO change after the reference count has dropped to zero but before the corresponding release callback has been executed. This could allow the system to attempt accessing a file descriptor that is no longer valid, leading to potential security risks. Affected systems should ensure proper handling of file descriptors to avoid triggering the associated warnings and to maintain system integrity.

References