EUVD-2026-108845
GHSA-77g9-3gmv-7p3q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access with gpio-mpsse driver privileges
-
DeliveryEnable IRQ to arm poll worker
-
ExploitRace USB disconnect against publish window
-
ExecutionOrphaned worker dereferences freed mpsse_priv
-
ImpactCorrupt kernel memory for code execution/escalation
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires (1) a physically attached FTDI MPSSE-based USB GPIO adapter bound to the gpio-mpsse driver - this driver is not loaded in typical deployments; (2) local access with sufficient privilege to call gpio_mpsse_irq_enable() (arm an IRQ poll worker) on that chip; and (3) winning the race between schedule_work() arming the worker and gpio_mpsse_disconnect() walking priv->workers, i.e. triggering device disconnect inside that narrow window. Limiting factors: no network vector (AV:L), the specialized hardware dependency, the per-disconnect timing precision the race demands, and the pre-authentication privilege (PR:L) needed to reach the code path all sharply constrain realistic exploitation despite the high CVSS. |
| Impact | The CVSS base score of 7.8 (HIGH) is driven almost entirely by the impact metrics (C:H/I:H/A:H) that are typical of any kernel use-after-free, not by ease of reach: the supplied vector is AV:L/AC:L/PR:L/UI:N, i.e. local access with some privilege is required, not a network-exploitable flaw. The real-world signals point to low urgency: EPSS is 0.21% (10th percentile), the CVE is not in CISA KEV, and no public exploit is identified - the bug was found by an in-house static analysis tool, not observed in use. Exploitation additionally depends on niche hardware (an FTDI MPSSE-based USB GPIO adapter bound to the gpio-mpsse driver) and on winning a narrow race between arming the poll worker and the disconnect walk. The vuln.today 'this_week' decision label and the available vendor patch reflect normal stable-tree patch hygiene rather than an active-threat emergency. Net assessment: a legitimate kernel correctness bug worth patching in the next maintenance cycle, but a high-CVSS / low-real-risk item for the vast majority of environments, not a drop-everything priority. Note one metadata inconsistency: the tag labels this 'Information Disclosure', yet the description and the C:H/I:H/A:H impact describe a use-after-free with full memory-corruption potential, which exceeds mere disclosure. |
| Exploit ScenarioDerived | A local user able to exercise the gpio-mpsse driver enables an IRQ on an attached FTDI MPSSE GPIO adapter and then triggers a USB disconnect in the brief window after schedule_work() runs but before the worker is published to priv->workers; the disconnect misses the orphaned worker, the USB core frees mpsse_priv, and the still-running gpio_mpsse_poll() work dereferences the freed structure. No public PoC exists - the issue was identified by an in-house static analysis tool - and the tight timing of the race makes reliable triggering difficult. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
Use-after-free in the Linux kernel's gpio-mpsse driver, reachable only by a local user with the privilege to arm the IRQ poll worker on an attached FTDI MPSSE-based USB GPIO adapter, when a device disconnect lands in the narrow window between schedule_work() and the worker being published to priv->workers. The window lets gpio_mpsse_disconnect() miss the orphaned worker, which then keeps touching mpsse_priv after the USB core frees it; the assessed vector is AV:L/AC:H/PR:L/UI:N with high confidentiality, integrity and availability impact, so the 7.8 base score reflects memory-corruption consequences rather than ease of reach. The driver is not loaded in typical deployments, EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and vendor stable fixes are listed (6.18.57, 7.2.11, 7.3).
RemediationAI
Vendor-released patch: update to Linux 6.18.57, 7.2.11 or 7.3, which contain the fix commits https://git.kernel.org/stable/c/76390ac0bca7e5058b7482eb4d951c3bda5df812, https://git.kernel.org/stable/c/c0071ee496e1228976c72b096f529503222708a0 and https://git.kernel.org/stable/c/7efa1a1953cd6b20b23a3524d5b4b81789c6ef25; the priority signal places this within this week's patch cycle rather than an emergency. Distributions that backport the fix should confirm the equivalent of the irq_spin publication/dying-flag rework plus the kfree_rcu() conversion on PREEMPT_RT kernels. Where an immediate kernel update is not feasible, the exposure is limited to hosts that load gpio-mpsse: on systems that do not need FTDI MPSSE GPIO adapters, blacklisting or not building that module removes the vulnerable path entirely, at the cost of making such adapters unusable; on hosts that do require it, restricting physical and USB-port access to trusted users narrows the local and hardware preconditions without removing the race itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
gpio-mpsse is a Linux GPIO driver for FTDI MPSSE-capable USB bridge chips used as GPIO adapters; its IRQ emulation relies on a workqueue poller (gpio_mpsse_poll()) registered in priv->workers and cancelled during gpio_mpsse_disconnect() with cancel_work_sync(). The root cause is an ordering/lifetime bug of the use-after-free class (no CWE identifier was assigned in the source data): gpio_mpsse_irq_enable() called schedule_work() before adding the worker to priv->workers, so a teardown walk of that list could complete without seeing the worker, after which the USB core released mpsse_priv and the still-queued poll callback dereferenced freed memory. The upstream fix publishes and arms the worker inside a single irq_spin (raw spinlock) critical section, matching the teardown walk which takes the same lock, so any worker found on the list is guaranteed armed and cancel_work_sync() covers it whether queued or running. A worker armed after the disconnect walk would still be missed, so a new priv->dying flag is set under irq_spin before the walk and re-checked in the same section, with the structure released via kfree_rcu() instead of kfree() in the going-away path because kfree() can be called with the IRQ core's raw spinlock held and may sleep on PREEMPT_RT; schedule_work() is safe under irq_spin and the next probe allocates a fresh mpsse_priv, so the flag never needs clearing. Exploitation requires physical presence of a bound MPSSE adapter, local privilege to enter the IRQ-enable path, and precise timing of a disconnect inside the race window.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local hardware/driver access only (AV:L); the described disconnect race makes the trigger timing-dependent (AC:H); reaching the IRQ path needs privilege (PR:L); kernel UAF yields full memory impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
gpio: mpsse: fix race when arming the IRQ poll worker
gpio_mpsse_irq_enable() arms the poll worker before publishing it: schedule_work() runs before the worker is added to priv->workers. If gpio_mpsse_disconnect() walks the list in that window it misses the worker, and once disconnect returns, the USB core frees mpsse_priv while the orphaned gpio_mpsse_poll() work keeps accessing it, causing a use-after-free.
Fix this by publishing and arming the worker in one irq_spin critical section. Teardown walks the same list under irq_spin, so a worker found on the list is guaranteed to be armed, and cancel_work_sync() handles it whether it is queued or running.
A worker armed after the disconnect walk would still be missed, so also set a new priv->dying flag under irq_spin before the teardown walk, and check it in the same critical section, freeing it via kfree_rcu() instead when the device is going away, since kfree() would be called with the IRQ core's raw spinlock held and may sleep on PREEMPT_RT. schedule_work() is safe to call with irq_spin held, and the next probe gets a fresh mpsse_priv, so the flag never needs to be cleared.
This issue was found by an in-house static analysis tool.
Executive ViewAI
CVE-2026-99050 is a high-severity use-after-free in the Linux kernel's gpio-mpsse driver that, if exploited, could allow local privilege escalation with high impact on confidentiality, integrity, and availability. Only systems with an attached FTDI MPSSE-based USB GPIO adapter and local user access with IRQ arming privilege are exposed, which limits the attack surface but still poses a risk to specialized or embedded environments. Leadership should prioritize patch deployment for affected systems, as the vulnerability enables memory corruption that could be leveraged for lateral movement or data compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB