CVE-2026-31732 gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
A resource leak in the Linux kernel GPIO subsystem can lead to memory exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31732?
CVE-2026-31732 is a medium-severity memory corruption vulnerability in Linux kernel, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
Since commit aab5c6f20023 ("gpio: set device type for GPIO chips"), `gdev->dev.release` is unset. As a result, the reference count to `gdev->dev` isn't dropped on the error handling paths.
Drop the reference on errors.
Also reorder the instructions to make the error handling simpler. Now gpiochip_add_data_with_key() roughly looks like:
>>> Some memory allocation. Go to ERR ZONE 1 on errors. >>> device_initialize().
gpiodev_release() takes over the responsibility for freeing the resources of `gdev->dev`. The subsequent error handling paths shouldn't go through ERR ZONE 1 again which leads to double free.
>>> Some initialization mainly on `gdev`. >>> The rest of initialization. Go to ERR ZONE 2 on errors. >>> Chip registration success and exit.
>>> ERR ZONE 2. gpio_device_put() and exit. >>> ERR ZONE 1.
Weakness: CWE-401
Which versions are affected by CVE-2026-31732?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31732?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-31732 being exploited?
There is no known exploitation of CVE-2026-31732 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-31732, DEBIAN-CVE-2026-31732, GHSA-fv85-jgqf-p95r, ROOT-OS-DEBIAN-13-CVE-2026-31732, UBUNTU-CVE-2026-31732.