CVE-2026-31732 (GCVE-0-2026-31732)

Vulnerability from cvelistv5 – Published: 2026-05-01 14:14 – Updated: 2026-07-04 11:50
VLAI
Title
gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()
Summary
In the Linux kernel, the following vulnerability has been resolved: gpio: Fix resource leaks on errors in gpiochip_add_data_with_key() Since commit aab5c6f20023 ("gpio: set device type for GPIO chips"), `gdev->dev.release` is unset. As a result, the reference count to `gdev->dev` isn't dropped on the error handling paths. Drop the reference on errors. Also reorder the instructions to make the error handling simpler. Now gpiochip_add_data_with_key() roughly looks like: >>> Some memory allocation. Go to ERR ZONE 1 on errors. >>> device_initialize(). gpiodev_release() takes over the responsibility for freeing the resources of `gdev->dev`. The subsequent error handling paths shouldn't go through ERR ZONE 1 again which leads to double free. >>> Some initialization mainly on `gdev`. >>> The rest of initialization. Go to ERR ZONE 2 on errors. >>> Chip registration success and exit. >>> ERR ZONE 2. gpio_device_put() and exit. >>> ERR ZONE 1.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: aab5c6f200238ac45001bec3d5494fff8438a8dc , < a500e1837c4266ddb05b39b3e1cc71f49a43ffa5 (git)
Affected: aab5c6f200238ac45001bec3d5494fff8438a8dc , < f0cf9c7b7c281956cc0dec163132cd96f76e1d60 (git)
Affected: aab5c6f200238ac45001bec3d5494fff8438a8dc , < fb4584d2b324c522404c733c65840a1a6519ada8 (git)
Affected: aab5c6f200238ac45001bec3d5494fff8438a8dc , < 16fdabe143fce2cbf89139677728e17e21b46c28 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.22 , ≤ 6.18.* (semver)
Unaffected: 6.19.12 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a500e1837c4266ddb05b39b3e1cc71f49a43ffa5",
              "status": "affected",
              "version": "aab5c6f200238ac45001bec3d5494fff8438a8dc",
              "versionType": "git"
            },
            {
              "lessThan": "f0cf9c7b7c281956cc0dec163132cd96f76e1d60",
              "status": "affected",
              "version": "aab5c6f200238ac45001bec3d5494fff8438a8dc",
              "versionType": "git"
            },
            {
              "lessThan": "fb4584d2b324c522404c733c65840a1a6519ada8",
              "status": "affected",
              "version": "aab5c6f200238ac45001bec3d5494fff8438a8dc",
              "versionType": "git"
            },
            {
              "lessThan": "16fdabe143fce2cbf89139677728e17e21b46c28",
              "status": "affected",
              "version": "aab5c6f200238ac45001bec3d5494fff8438a8dc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpiolib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: Fix resource leaks on errors in gpiochip_add_data_with_key()\n\nSince commit aab5c6f20023 (\"gpio: set device type for GPIO chips\"),\n`gdev-\u003edev.release` is unset.  As a result, the reference count to\n`gdev-\u003edev` isn\u0027t dropped on the error handling paths.\n\nDrop the reference on errors.\n\nAlso reorder the instructions to make the error handling simpler.\nNow gpiochip_add_data_with_key() roughly looks like:\n\n   \u003e\u003e\u003e Some memory allocation.  Go to ERR ZONE 1 on errors.\n   \u003e\u003e\u003e device_initialize().\n\n   gpiodev_release() takes over the responsibility for freeing the\n   resources of `gdev-\u003edev`.  The subsequent error handling paths\n   shouldn\u0027t go through ERR ZONE 1 again which leads to double free.\n\n   \u003e\u003e\u003e Some initialization mainly on `gdev`.\n   \u003e\u003e\u003e The rest of initialization.  Go to ERR ZONE 2 on errors.\n   \u003e\u003e\u003e Chip registration success and exit.\n\n   \u003e\u003e\u003e ERR ZONE 2.  gpio_device_put() and exit.\n   \u003e\u003e\u003e ERR ZONE 1."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-04T11:50:32.706Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a500e1837c4266ddb05b39b3e1cc71f49a43ffa5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0cf9c7b7c281956cc0dec163132cd96f76e1d60"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb4584d2b324c522404c733c65840a1a6519ada8"
        },
        {
          "url": "https://git.kernel.org/stable/c/16fdabe143fce2cbf89139677728e17e21b46c28"
        }
      ],
      "title": "gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31732",
    "datePublished": "2026-05-01T14:14:30.844Z",
    "dateReserved": "2026-03-09T15:48:24.137Z",
    "dateUpdated": "2026-07-04T11:50:32.706Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31732",
      "date": "2026-09-21",
      "epss": "0.00122",
      "percentile": "0.02292"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpio/gpiolib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "a500e1837c4266ddb05b39b3e1cc71f49a43ffa5",
                    "status": "affected",
                    "version": "aab5c6f200238ac45001bec3d5494fff8438a8dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f0cf9c7b7c281956cc0dec163132cd96f76e1d60",
                    "status": "affected",
                    "version": "aab5c6f200238ac45001bec3d5494fff8438a8dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fb4584d2b324c522404c733c65840a1a6519ada8",
                    "status": "affected",
                    "version": "aab5c6f200238ac45001bec3d5494fff8438a8dc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "16fdabe143fce2cbf89139677728e17e21b46c28",
                    "status": "affected",
                    "version": "aab5c6f200238ac45001bec3d5494fff8438a8dc",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/gpio/gpiolib.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.9"
                  },
                  {
                    "lessThan": "6.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.95",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.22",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "21ACBF2B-16E4-4D78-AB62-463FB9D3152C",
                    "versionEndExcluding": "6.18.22",
                    "versionStartIncluding": "6.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36",
                    "versionEndExcluding": "6.19.12",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: Fix resource leaks on errors in gpiochip_add_data_with_key()\n\nSince commit aab5c6f20023 (\"gpio: set device type for GPIO chips\"),\n`gdev-\u003edev.release` is unset.  As a result, the reference count to\n`gdev-\u003edev` isn\u0027t dropped on the error handling paths.\n\nDrop the reference on errors.\n\nAlso reorder the instructions to make the error handling simpler.\nNow gpiochip_add_data_with_key() roughly looks like:\n\n   \u003e\u003e\u003e Some memory allocation.  Go to ERR ZONE 1 on errors.\n   \u003e\u003e\u003e device_initialize().\n\n   gpiodev_release() takes over the responsibility for freeing the\n   resources of `gdev-\u003edev`.  The subsequent error handling paths\n   shouldn\u0027t go through ERR ZONE 1 again which leads to double free.\n\n   \u003e\u003e\u003e Some initialization mainly on `gdev`.\n   \u003e\u003e\u003e The rest of initialization.  Go to ERR ZONE 2 on errors.\n   \u003e\u003e\u003e Chip registration success and exit.\n\n   \u003e\u003e\u003e ERR ZONE 2.  gpio_device_put() and exit.\n   \u003e\u003e\u003e ERR ZONE 1."
          }
        ],
        "id": "CVE-2026-31732",
        "lastModified": "2026-07-04T12:16:55.690",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-05-01T15:16:35.807",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/16fdabe143fce2cbf89139677728e17e21b46c28"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a500e1837c4266ddb05b39b3e1cc71f49a43ffa5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f0cf9c7b7c281956cc0dec163132cd96f76e1d60"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fb4584d2b324c522404c733c65840a1a6519ada8"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-401"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T11:19:51+00:00",
      "cve": "CVE-2026-31732",
      "id": "CVE-2026-31732",
      "initial_release_date": "2026-05-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gpio: Fix resource leaks on errors in gpiochip_add_data_with_key()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31732.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-06-16T02:21:54Z",
      "cve": "CVE-2026-31732",
      "id": "CVE-2026-31732",
      "initial_release_date": "2026-05-06T01:43:20Z",
      "product_status:known_affected": "287",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31732",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31732.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.