AZL-110795
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110795.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-110795
- Upstream
- Published
- 2026-10-23T13:17:18Z
- Modified
- 2026-10-25T05:30:37Z
- Summary
- CVE-2026-98971 affecting package kernel 6.6.157.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
gpio: exar: initialize the ID before registering its cleanup
devm_add_action_or_reset() invokes the cleanup action immediately when registering the action fails. gpio_exar_probe() currently stores the allocated ID in exar_gpio only after registering the action, so that failure makes exar_devm_ida_free() release ID 0. If the allocated ID is nonzero, this leaks that ID and can free ID 0 belonging to another device.
Store the ID before registering the cleanup action so both the immediate failure path and normal device teardown release the correct allocation.
- References