Use-After-Free Vulnerability in Linux Kernel Affecting x86 Android Tablets

CVE-2026-98397

What is CVE-2026-98397?

A vulnerability in the Linux kernel related to x86 Android tablets exists due to improper device reference handling in the gpio_secondary_fwnode_init function. When acquiring a device reference through acpi_bus_find_device_by_name(), the system fails to maintain that reference appropriately, resulting in the potential for a use-after-free condition if the device is released prematurely. This mismanagement can lead to serious stability issues during driver teardown operations. Proper handling requires explicit acquisition of device references using get_device() during devres action registration, ensuring safe memory management throughout the operational lifecycle.

References