Linux Kernel Vulnerability in GPIO Handling by Vendor

CVE-2026-99257

What is CVE-2026-99257?

In the Linux kernel, a vulnerability has been identified related to the handling of shared GPIOs. The existing mechanism for platform lookup requires a struct device to operate effectively. However, when a fwnode-based lookup is attempted without an associated device, it may lead to a NULL pointer dereference. This issue is addressed by introducing a check that allows the kernel to manage such cases gracefully, preventing system crashes that could arise from this error condition. This approach not only mitigates immediate risks but also lays the groundwork for future enhancements to this functionality.

References