CVE-2026-31763

Vulnerability

Description

In the Linux kernel's IIO gyroscope driver for the MPU3050, a bug exists in the IRQ teardown path. The driver registers mpu3050->trig as the interrupt handler, but when calling free_irq(), it incorrectly passes the device structure mpu3050 instead of the trigger handler. This mismatch can lead to improper cleanup, potentially causing a use-after-free or other memory corruption issues [1][2][3][4].

Exploitation

Conditions

The vulnerability is triggered during driver removal or error handling that invokes the teardown sequence. An attacker would need local access to the system and the ability to interact with the IIO subsystem, such as unloading the kernel module or inducing an error that forces cleanup. No special privileges are required beyond local user access, making it a local attack vector.

Impact

If exploited, the incorrect free_irq() call could result in a kernel crash (denial of service) or, in more severe cases, memory corruption that might be leveraged for privilege escalation. The CVSS v3 score of 5.5 (Medium) reflects the limited attack surface and the need for local access.

Mitigation

The fix corrects the free_irq() call to use the proper handler pointer (mpu3050->trig). Patches have been applied to multiple stable kernel branches [1][2][3][4]. Users should update their kernel to a version containing the fix to eliminate the vulnerability.