CVE-2026-99162

What it actually does

Use-after-free in GPIO shared proxy handling where a lookup table retains a pointer to a kobject name string that has already been freed, allowing the dev_id field to reference invalid memory.

Why it matters to the business

Kernel instability or crashes on systems using GPIO shared lookups, potentially leading to denial of service; low immediate risk given stable low exploit probability and no known campaigns.

How an attack unfolds

An attacker with local access crafts GPIO lookup operations that extend the lifetime of the table beyond the kobject, then triggers reuse of the freed name string to corrupt kernel memory or cause a crash.

How to fix it

Apply the upstream kernel patch that duplicates the name string instead of assigning the kobject pointer; rebuild and deploy updated kernels to affected distributions.

How to confirm the fix worked

Inspect kernel source for the string duplication fix in gpio shared lookup code; verify the change is present after patching and test GPIO registration paths for stability.

Typical attack path

1. Obtain local code execution or access on a Linux system
2. Trigger GPIO shared proxy registration that populates the lookup table
3. Force kobject release while the table remains referenced
4. Reuse the dangling dev_id pointer to induce UAF behavior

How to detect it

Review kernel logs for use-after-free warnings or oops traces mentioning gpio shared or lookup tables; correlate with processes performing GPIO device registration.

What your security team should do

• Prioritize kernel updates on systems with heavy GPIO usage within standard patching cycles
• Monitor kernel oops and crash reports for GPIO-related UAF signatures
• Review downstream device trees or drivers that register shared GPIO lookups