VYPR
← All advisories
High severity7.8NVD Advisory· Published Jul 19, 2026· Updated Oct 13, 2026

CVE-2026-64023

CVE-2026-64023

Description

In the Linux kernel, the following vulnerability has been resolved:

gpio: aggregator: fix a potential use-after-free

On error we free aggr->lookups->dev_id before removing the entry from the lookup table. If a concurrent thread calls gpiod_find() before we remove the entry, it could iterate over the list and call gpiod_match_lookup_table() which unconditionally dereferences dev_id when calling strcmp(). Reverse the order of cleanup.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • Linux/Kernelllm-fuzzy6 versions
    (expand)+ 5 more
    • (no CPE)
    • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=6.16,<6.18.34
    • cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*
  • osv-coords
    pkg:linux/kernel
    Range: >= 6.16.0, < 6.18.34

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.