CVE-2026-98397platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpio_secondary_fwnode_init(), acpi_bus_find_device_by_name() returns a device reference, but the local dev variable is declared with __free(put_device), dropping the reference at the end of each iteration. Meanwhile, devm_add_action_or_reset() saves the dev pointer for gpio_secondary_unset() without incrementing its reference count, which could lead to a use-after-free during driver teardown if the device is released in the interim. Acquire an explicit device reference with get_device() when registering the devres action, and drop it with put_device() inside gpio_secondary_unset().
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 14, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1448c2d2ca5cc7f4ea6694e6bc809946de0a751c before c62b6e081119f2ab03cfcafde1f83c0f50e8e726; from 1448c2d2ca5cc7f4ea6694e6bc809946de0a751c before 144113b0a70fa18033a747ee5db6803308f7688c | CNA record |
References
- https://git.kernel.org/stable/c/c62b6e081119f2ab03cfcafde1f83c0f50e8e726
- https://git.kernel.org/stable/c/144113b0a70fa18033a747ee5db6803308f7688c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.