Double Free Vulnerability in Linux Kernel Affects ThinkPad X9 Devices

CVE-2025-40296

What is CVE-2025-40296?

A vulnerability in the Linux kernel related to the GPIO device management has been identified, specifically impacting ThinkPad X9 devices. This issue arises during the unregistration of GPIO devices, leading to a double free condition which can cause random failures as other drivers, notably Intel THC, attempt to allocate interrupts. The trouble is traced back to an unexpected drop in the reference count of the pinctrl_intel_platform module when its probe is deferred. To mitigate this flaw, the redundant release of the GPIO device during the regulator's unregistration process has been removed, ensuring system stability and security.

References