In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup… (CVE-2026-98971)

The Linux kernel gpio: exar driver had a flaw where the allocated ID was stored only after registering a cleanup action. If registering the cleanup action failed, the immediate invocation of the cleanup would free ID 0 incorrectly and leak the allocated nonzero ID. The fix involves storing the allocated ID before registering the cleanup action, ensuring that both immediate failure and normal teardown paths release the correct ID.

Incorrect ID management could lead to resource leaks and the freeing of an ID belonging to another device, potentially causing device mismanagement or instability in the kernel's GPIO subsystem. There is no indication of direct security compromise such as privilege escalation or code execution.

A fix has been applied in the Linux kernel to store the allocated ID before registering the cleanup action, preventing ID leaks and incorrect freeing. Users should update to the fixed kernel version once available. Patch status is not explicitly stated; check the vendor or Linux kernel advisory for the specific fixed version.