CVE-2026-98971

What it actually does

The gpio_exar_probe function stores an allocated device ID in exar_gpio only after calling devm_add_action_or_reset; on registration failure the cleanup handler releases ID 0 instead of the correct nonzero ID, producing an ID leak or erroneous free of another device's ID.

Why it matters to the business

Systems using Exar GPIO hardware may experience resource exhaustion or unexpected device behavior after driver load failures; the issue was disclosed two days ago with negligible exploit probability and no known threat-actor activity.

How an attack unfolds

An attacker would need to trigger repeated probe failures on an Exar GPIO device while other devices concurrently allocate IDs, causing the kernel to free an ID still in use by another instance and potentially leading to subsequent use-after-free when that ID is reused.

How to fix it

Update to a Linux kernel containing the commit that stores the ID before registering the devm cleanup action; no downstream fixed-version packages were listed.

How to confirm the fix worked

Confirm the source change that moves the ID assignment before devm_add_action_or_reset is present in the running kernel tree; recompile and test probe-failure paths with multiple Exar devices.

Typical attack path

1. Gain local access to a system with an Exar GPIO device
2. Induce repeated gpio_exar_probe failures (e.g., via module reload or hardware manipulation)
3. Force concurrent ID allocations from other drivers
4. Trigger reuse of the erroneously freed ID to reach use-after-free

How to detect it

Examine kernel logs for exar probe failures followed by warnings about ID 0 being freed; no public threat-actor campaigns or ransomware usage have been reported for this issue.

What your security team should do

• Monitor upstream stable kernel releases for the gpio-exar fix
• Prioritize patching on any multi-device Exar GPIO deployments once available
• Review kernel logs for repeated exar probe failures as an operational health signal