In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_enable()… (CVE-2026-99050)

The vulnerability in the Linux kernel gpio mpsse driver involved a race condition in gpio_mpsse_irq_enable() where the IRQ poll worker was scheduled before being added to the internal worker list. If gpio_mpsse_disconnect() traversed the worker list during this window, it could miss the worker, leading to the USB core freeing the associated memory (mpsse_priv) while the orphaned poll worker still accessed it. This use-after-free was addressed by publishing and arming the worker atomically within an irq_spin critical section, adding a dying flag to coordinate teardown, and using kfree_rcu() to safely free memory without sleeping under the IRQ spinlock. The issue was identified via an internal static analysis tool.

The vulnerability could cause use-after-free memory access in the Linux kernel gpio mpsse driver, potentially leading to kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to affected kernel versions using this driver and depends on triggering the race condition during device disconnect.

A fix is available that addresses the race condition by changing the worker arming and teardown logic to be atomic and safe under IRQ spinlocks. Users should apply the official Linux kernel updates that include this patch. No additional mitigations are indicated by the vendor advisory.