Cloudanix VulnDB

CVE-2026-98397

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A memory-handling mistake in the Linux kernel for certain tablet devices could let attackers crash the system or run code if they already have access to the machine.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in Linux kernel x86-android-tablets driver caused by mismatched device reference counting: acpi_bus_find_device_by_name reference is dropped by __free(put_device) while devm_add_action_or_reset stores the pointer for later gpio_secondary_unset without incrementing the count.

Why it matters to the business

Kernel instability, crashes, or potential local code execution on systems using the affected driver, increasing downtime and patching urgency for organizations running recent mainline kernels on x86 Android tablet hardware.

How an attack unfolds

An attacker with local access triggers repeated driver load/unload cycles or device enumeration that causes the saved pointer to become invalid; during teardown the freed device memory is dereferenced leading to UAF.

How to fix it

Upgrade to a kernel containing the referenced commit that adds get_device before devm_add_action_or_reset and put_device inside gpio_secondary_unset; rebuild and deploy the updated kernel across affected fleets.

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or binary; inspect /sys/kernel/debug/devices_deferred or reproduce driver teardown under memory pressure to verify absence of UAF warnings.

Typical attack path

  1. Obtain local shell on target Linux system
  2. Trigger gpio_secondary_fwnode_init via ACPI device enumeration or module reload
  3. Force premature device release between reference drop and devres action execution
  4. Execute code or cause denial-of-service via freed memory access during gpio_secondary_unset

How to detect it

Search kernel logs and dmesg for slab-use-after-free or general protection faults involving gpio_secondary_fwnode or x86-android-tablets; correlate with device hotplug or ACPI enumeration events.

What your security team should do

  • Identify all systems running kernels between the vulnerable commit and the fix commit
  • Prioritize patching within normal change windows given low EPSS and no KEV listing
  • Monitor kernel logs for related oops or slab-use-after-free reports until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpio_secondary_fwnode_init(), acpi_bus_find_device_by_name() returns a device reference, but the local dev variable is declared with __free(put_device), dropping the reference at the end of each iteration. Meanwhile, devm_add_action_or_reset() saves the dev pointer for gpio_secondary_unset() without incrementing its reference count, which could lead to a use-after-free during driver teardown if the device is released in the interim. Acquire an explicit device reference with get_device() when registering the devres action, and drop it with put_device() inside gpio_secondary_unset().

Affected packages

Ecosystem Package Introduced Fixed