CVE-2026-98528 gpio: cdev: fix kernel stack leak to user-space in error path
A local attacker can read uninitialized kernel stack memory via a GPIO character device error path, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98528?
CVE-2026-98528 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
gpio: cdev: fix kernel stack leak to user-space in error path
If we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we return immediately before zeroing the info struct we'll end up passing to the user-space later in lineinfo_get_v1(). This may leak the kernel stack contents. Make gpio_desc_to_lineinfo() return int so that the -ENODEV returned on failure to acquire the guard can be propagated to the callers.
While not strictly necessary: move the memset() before trying to acquire the SRCU read lock too for good measure.
Which versions are affected by CVE-2026-98528?
How do I fix CVE-2026-98528?
Apply the vendor's patch.
Is CVE-2026-98528 being exploited?
There is no known exploitation of CVE-2026-98528 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98528, DEBIAN-CVE-2026-98528, GHSA-2259-3wph-4x6g, UBUNTU-CVE-2026-98528.