CVE-2026-43181

The vulnerability resides in the GPIO sysfs interface. When a GPIO is exported via sysfs and the parent GPIO controller is subsequently removed (e.g., by unbinding the driver), the exported attribute is not cleaned up. This occurs because the association between the GPIO descriptor and the device is lost during removal, preventing the final reference count from being dropped [1].

To exploit this, an attacker needs local access to export GPIOs via sysfs and trigger the removal of the GPIO controller. This could be achieved by an unprivileged user if they have permission to write to the sysfs export files and unbind the controller driver. The attack surface is limited to users with sufficient privileges on the sysfs filesystem.

The impact is a residual sysfs entry that cannot be removed, leading to a kernel memory leak of the GPIO descriptor and associated structures. While the CVSS score is Medium (5.5), repeated exploitation could cause resource exhaustion, affecting system availability.

The fix has been applied to the Linux kernel stable tree via commits [1], [2], and [3]. These commits rework the teardown code to provide an unlocked variant of gpiod_unexport() and remove all exported GPIOs with the sysfs_lock taken before unregistering the parent device. Users should update to the latest stable kernel to mitigate this issue.