CVE-2026-98397 platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown
A use-after-free in the Linux kernel x86-android-tablets driver allows local attackers to potentially execute code or escalate privileges during device teardown.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98397?
CVE-2026-98397 is an use after free vulnerability in Linux, published on 14 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown
In gpio_secondary_fwnode_init(), acpi_bus_find_device_by_name() returns a device reference, but the local dev variable is declared with __free(put_device), dropping the reference at the end of each iteration. Meanwhile, devm_add_action_or_reset() saves the dev pointer for gpio_secondary_unset() without incrementing its reference count, which could lead to a use-after-free during driver teardown if the device is released in the interim.
Acquire an explicit device reference with get_device() when registering the devres action, and drop it with put_device() inside gpio_secondary_unset().
Which versions are affected by CVE-2026-98397?
How do I fix CVE-2026-98397?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98397 being exploited?
There is no known exploitation of CVE-2026-98397 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-98397, GHSA-hwxj-pq7h-rq2r, UBUNTU-CVE-2026-98397.