Cloudanix VulnDB

CVE-2026-99050

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A recently discovered flaw in how the Linux kernel manages certain USB-connected GPIO devices could let a logged-in user crash the computer or possibly run code with higher privileges.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in gpio_mpsse_irq_enable allows schedule_work to execute before the worker is published to the priv->workers list; gpio_mpsse_disconnect can therefore miss the worker, return, and let the USB core free mpsse_priv while gpio_mpsse_poll still accesses it, producing a use-after-free.

Why it matters to the business

Local users on systems exposing the affected MPSSE GPIO USB devices can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation; the flaw is only two days old and affects any kernel containing the driver.

How an attack unfolds

An attacker with local access enables an IRQ on the MPSSE device, races the disconnect path, and causes the orphaned poll worker to dereference already-freed kernel memory after the device teardown completes.

How to fix it

Update to a kernel containing the fix that publishes and arms the worker inside a single irq_spin critical section, sets the priv->dying flag before teardown, and uses kfree_rcu; apply the patch or a subsequent stable update as soon as it becomes available in your distribution.

How to confirm the fix worked

Confirm the driver source contains the irq_spin-protected publish/arm sequence and the priv->dying check; verify that gpio_mpsse_disconnect walks the worker list under the same lock and that cancel_work_sync is used for any discovered workers.

Typical attack path

  1. Obtain local user privileges on a Linux system with the gpio-mpsse driver loaded
  2. Open and arm an IRQ on the MPSSE USB GPIO device
  3. Trigger device disconnect while the worker is being scheduled
  4. Cause the freed mpsse_priv structure to be accessed by the still-running poll worker

How to detect it

Look for kernel oops or panic logs referencing gpio_mpsse_poll or mpsse_priv after USB disconnect events; examine dmesg and kernel logs for use-after-free warnings involving the MPSSE worker; no public exploitation artifacts are known.

What your security team should do

  • Prioritize kernel updates containing the gpio-mpsse race fix for all affected distributions
  • Restrict local access to systems that expose MPSSE USB GPIO devices until patched
  • Monitor upstream stable kernels and distribution security advisories for the corrected version

The record

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_enable() arms the poll worker before publishing it: schedule_work() runs before the worker is added to priv->workers. If gpio_mpsse_disconnect() walks the list in that window it misses the worker, and once disconnect returns, the USB core frees mpsse_priv while the orphaned gpio_mpsse_poll() work keeps accessing it, causing a use-after-free. Fix this by publishing and arming the worker in one irq_spin critical section. Teardown walks the same list under irq_spin, so a worker found on the list is guaranteed to be armed, and cancel_work_sync() handles it whether it is queued or running. A worker armed after the disconnect walk would still be missed, so also set a new priv->dying flag under irq_spin before the teardown walk, and check it in the same critical section, freeing it via kfree_rcu() instead when the device is going away, since kfree() would be called with the IRQ core's raw spinlock held and may sleep on PREEMPT_RT. schedule_work() is safe to call with irq_spin held, and the next probe gets a fresh mpsse_priv, so the flag never needs to be cleared. This issue was found by an in-house static analysis tool.

Affected packages

Ecosystem Package Introduced Fixed