CVE-2026-31732 Linux CVE debrief

Who should care

Linux kernel developers, maintainers, and users who rely on the gpiochip_add_data_with_key() function should be aware of this vulnerability. They should review their kernel versions and apply patches or updates as needed to prevent potential resource leaks.

Technical summary

The gpiochip_add_data_with_key() function in the Linux kernel has a vulnerability that can cause resource leaks on errors. The issue arises from the fact that the release function for the device is unset, leading to a failure to drop the reference count to the device on error handling paths. This vulnerability affects Linux kernel versions 6.9 to 6.18.22, 6.19 to 6.19.12, and 7.0 RC1 to RC6. The Common Vulnerabilities and Exposures (CVE) score for this vulnerability is 5.5, with a severity rating of MEDIUM.

Defensive priority

Apply patches or updates to the Linux kernel to fix the vulnerability in the gpiochip_add_data_with_key() function. Review kernel versions and ensure they are up-to-date to prevent potential resource leaks.

Recommended defensive actions

• Apply patches or updates to the Linux kernel to fix the vulnerability in the gpiochip_add_data_with_key() function.
• Review kernel versions and ensure they are up-to-date to prevent potential resource leaks.
• Monitor Linux kernel updates and patches for future vulnerabilities.
• Consider implementing additional security measures to prevent potential attacks.
• Review and update incident response plans to address potential vulnerabilities.

Evidence notes

The vulnerability was introduced by a commit that unset the release function for the device. The Common Vulnerabilities and Exposures (CVE) score for this vulnerability is 5.5, with a severity rating of MEDIUM. Linux kernel versions 6.9 to 6.18.22, 6.19 to 6.19.12, and 7.0 RC1 to RC6 are affected.

Official resources