In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to… (CVE-2026-98528)

The Linux kernel contained a vulnerability in the gpio: cdev component where, if gpio_desc_to_lineinfo() failed to acquire the GPIO chip guard, it would return immediately without zeroing the info struct. This struct is later passed to user-space in lineinfo_get_v1(), potentially leaking kernel stack contents. The fix involved changing gpio_desc_to_lineinfo() to return an int error code (-ENODEV) on failure and zeroing the info struct before attempting to acquire the SRCU read lock, preventing kernel stack leakage.

The vulnerability could lead to unintended disclosure of kernel stack contents to user-space processes, potentially exposing sensitive kernel memory data. There is no indication of active exploitation in the wild. The impact is primarily an information leak from kernel to user-space.

A fix has been implemented in the Linux kernel to address this vulnerability. Users should apply the official kernel updates that include this patch. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation.