Cloudanix VulnDB

CVE-2026-99190

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small coding mistake in the Linux kernel can cause memory to be lost during rare hardware control operations, potentially making systems slower or unstable if it happens often.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory leak occurs when gpiod_set_array_value_complex() returns early after gpiochip_set_multiple() fails, skipping bitmap_free() for allocated bitmaps.

Why it matters to the business

Repeated triggering of the rare error path can slowly exhaust kernel memory, leading to performance degradation or system instability over time in affected Linux environments.

How an attack unfolds

An attacker would need to induce the specific gpiochip_set_multiple() failure condition during array value setting operations; the leak is passive and does not enable direct code execution or privilege escalation.

How to fix it

Apply the upstream kernel patch that moves the return code check after the bitmap_free() block; rebuild and deploy updated kernel images across affected systems.

How to confirm the fix worked

Confirm the source change in gpiolib.c ensures bitmap_free() executes on all paths; test by forcing the error condition and monitoring for leaks with kmemleak or similar tools.

Typical attack path

  1. Identify or trigger gpio array operations that invoke gpiod_set_array_value_complex()
  2. Force gpiochip_set_multiple() to fail
  3. Observe gradual memory consumption without bitmap release

How to detect it

Examine kernel logs for repeated gpiochip_set_multiple failures; use memory leak detectors like kmemleak to identify unreleased bitmap allocations tied to gpio array functions.

What your security team should do

  • Prioritize kernel updates in environments with heavy GPIO usage
  • Monitor memory usage trends on systems running vulnerable kernels
  • Review any custom GPIO drivers for similar error handling patterns

The record

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths A drive-by review by Sashiko reports that, after a failed call to gpiochip_set_multiple(), gpiod_set_array_value() returns abruptly, bypassing the freeing of possibly alloced bitmaps, potentially leaking memory. It is an unlikely error path, but is possible. Defer the return code check until after the bitmap_free() block.

Affected packages

Ecosystem Package Introduced Fixed