From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF56E1B7F4 for ; Sat, 14 Feb 2026 16:05:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771085115; cv=none; b=q2e76pfehiIN+dcBK64xxzc700/DV3RlzAbt8L7M9TnCfImynidcCI71eV9s1Qxttl25KQ3G6l/fUBCC/ZaRLHhx+VV2vwlP0MJ9JCTfSJV/DqtHN08Ka51Lm1VIqlDBClYYtBhm+UpUb7atzTzac6gTTFqvGGYu5RbzgAHOtzI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771085115; c=relaxed/simple; bh=3qmnvGeO0x/e9Dfcnf3bhUcTEx9+613FYSd3Up0nCQo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=CDjdG13OEpAJld2vgZZs1cJJKbQsrFtCcvm2sFQCzIl9gt3/KnD+SsBuVtjrItpqeuvCqnHuNNMGEeb+xHfE2VJ3J816RzihMW/qMadM+IiltE3A6x1InlLZFIqenFet5QndBLne4am9RTG3dNgZVztA+Ky4IPumEyJH79CZDY8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=KivNPmFJ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="KivNPmFJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 691DBC16AAE; Sat, 14 Feb 2026 16:05:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1771085114; bh=3qmnvGeO0x/e9Dfcnf3bhUcTEx9+613FYSd3Up0nCQo=; h=From:To:Cc:Subject:Date:Reply-To:From; b=KivNPmFJlSK/oZmH/pFpCATaKo/nXzb44uF8zjxiIusAgu0kyyG+MnH3vzRnweRAk zhmwq5IqVUqUvV6csVRNJCPVMhRBTZGCMnwS6EAMXo71ay1VImDNvC+CvRBcMQYCn2 q93M9GHQufv62pgXw6Sv2gWcrfD7tYVITDHaH9vE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-23158: gpio: virtuser: fix UAF in configfs release path Date: Sat, 14 Feb 2026 17:04:24 +0100 Message-ID: <2026021417-CVE-2026-23158-052d@gregkh> X-Mailer: git-send-email 2.53.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2620; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=97w2yiMZqH+5Z09ZLaiHDR0t9+JToMxTAtg1SaYj0Lg=; b=owGbwMvMwCRo6H6F97bub03G02pJDJkT5jLyt9zhuCp2IULFZu2Vh9byf69YPxAykbdilZz9a +nNrqJTHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCRE8cZFmxqKDl1TLrt+llu t3WSE1+L6qSL+DMs6JB8c/ur1qOdbrlHrT37l1zIdjB6BwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix UAF in configfs release path The gpio-virtuser configfs release path uses guard(mutex) to protect the device structure. However, the device is freed before the guard cleanup runs, causing mutex_unlock() to operate on freed memory. Specifically, gpio_virtuser_device_config_group_release() destroys the mutex and frees the device while still inside the guard(mutex) scope. When the function returns, the guard cleanup invokes mutex_unlock(&dev->lock), resulting in a slab use-after-free. Limit the mutex lifetime by using a scoped_guard() only around the activation check, so that the lock is released before mutex_destroy() and kfree() are called. The Linux kernel CVE team has assigned CVE-2026-23158 to this issue. Affected and fixed versions =========================== Issue introduced in 6.11 with commit 91581c4b3f29e2e22aeb1a62e842d529ca638b2d and fixed in 6.12.69 with commit 815a8e3bf72811d402b30bd4a53cde5e9df7a563 Issue introduced in 6.11 with commit 91581c4b3f29e2e22aeb1a62e842d529ca638b2d and fixed in 6.18.9 with commit 7bec90f605cfb138006f5ba575f2310593347110 Issue introduced in 6.11 with commit 91581c4b3f29e2e22aeb1a62e842d529ca638b2d and fixed in 6.19 with commit 53ad4a948a4586359b841d607c08fb16c5503230 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-23158 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/gpio/gpio-virtuser.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/815a8e3bf72811d402b30bd4a53cde5e9df7a563 https://git.kernel.org/stable/c/7bec90f605cfb138006f5ba575f2310593347110 https://git.kernel.org/stable/c/53ad4a948a4586359b841d607c08fb16c5503230