CVE-2026-99190 gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths

Not scored Published 28 Oct 2026 Updated 28 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-99190?

CVE-2026-99190 is a vulnerability in Linux, published on 28 Oct 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths

A drive-by review by Sashiko reports that, after a failed call to gpiochip_set_multiple(), gpiod_set_array_value() returns abruptly, bypassing the freeing of possibly alloced bitmaps, potentially leaking memory. It is an unlikely error path, but is possible.

Defer the return code check until after the bitmap_free() block.

Which versions are affected by CVE-2026-99190?

How do I fix CVE-2026-99190?

Upgrade to a fixed version.

Is CVE-2026-99190 being exploited?

There is no known exploitation of CVE-2026-99190 in the wild and no public exploit code.

Sources

Also known as BELL-CVE-2026-99190, DEBIAN-CVE-2026-99190, GHSA-8wj8-f84m-9qv6, UBUNTU-CVE-2026-99190.