Skip to main content

Linux Kernel CVE-2026-43181

| EUVDEUVD-2026-27743 MEDIUM
2026-05-06 Linux GHSA-gvr9-3x96-5w99
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local vector and low privileges required to export GPIOs via sysfs; sole impact is availability via kernel reference leak; no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 01:07 vuln.today
CVSS changed
May 11, 2026 - 21:07 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

gpio: sysfs: fix chip removal with GPIOs exported over sysfs

Currently if we export a GPIO over sysfs and unbind the parent GPIO controller, the exported attribute will remain under /sys/class/gpio because once we remove the parent device, we can no longer associate the descriptor with it in gpiod_unexport() and never drop the final reference.

Rework the teardown code: provide an unlocked variant of gpiod_unexport() and remove all exported GPIOs with the sysfs_lock taken before unregistering the parent device itself. This is done to prevent any new exports happening before we unregister the device completely.

AnalysisAI

GPIO sysfs teardown in the Linux kernel fails to drop the final sysfs attribute reference when a GPIO controller is unbound while pins remain exported, leaving stale /sys/class/gpio entries and causing a kernel availability impact on affected systems. Kernels from commit 1cd53df733c21ae0d344a2dec941a3e2a06fefd9 through the fix are affected, with patched stable releases at 6.18.16, 6.19.6, and 7.0; Red Hat and SUSE downstream kernels incorporating the affected range are similarly impacted. No public exploit exists and the EPSS score is 0.02% (4th percentile), making this primarily a stability concern for embedded Linux deployments actively using the GPIO sysfs interface.

Technical ContextAI

The Linux kernel GPIO subsystem exposes a sysfs interface under /sys/class/gpio that allows userspace to export, control, and monitor GPIO pins via the virtual filesystem. The kernel tracks exported pins using reference-counted descriptors tied to their parent GPIO controller device. The defect lies in the teardown path in gpio/sysfs: when the parent GPIO controller is unbound - whether by explicit driver unbind via sysfs or physical device removal - gpiod_unexport() can no longer associate the descriptor with the now-removed parent device, so it exits without dropping the final sysfs attribute reference. This is a missing resource release flaw (analogous to CWE-772) rooted in a race between device unregistration and sysfs attribute lifetime management; CWE is listed as N/A by NVD. The fix introduces an unlocked variant of gpiod_unexport() and forces cleanup of all exported GPIOs under sysfs_lock before the parent device is fully unregistered, closing the window where new exports could race against teardown. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to Linux kernel 6.18.16, 6.19.6, or 7.0, which incorporate the corrective commits for the gpio/sysfs teardown path. Patch commits are available directly at the kernel.org stable repository links listed above. Red Hat and SUSE customers should apply updated kernel packages from their respective security channels once available; neither vendor advisory was present in the provided references, so monitor vendor security portals for errata. Where immediate patching is not feasible on embedded or industrial systems, a targeted compensating control is to unexport all GPIO pins via /sys/class/gpio/unexport before initiating any GPIO controller driver unbind or hardware removal procedure; this eliminates the precondition for the reference leak. Alternatively, avoid use of the GPIO sysfs interface entirely and use the GPIO character device (/dev/gpiochipN) instead, which is not affected by this code path. Note that restricting GPIO sysfs access via udev rules does not protect already-exported pins.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43181 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy