← CVE announcements

SECURITY ANNOUNCEMENT

CVE-2026-99162

28 October 2026

The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup->dev_id. Fix a potential UAF by duplicating the string.

Introduced

6.19 a060b8c511abb0997381b397e52149a5e3e5259a

Fixed releases

7.2.13 8861491f8501516429e0e6c9d7a056480047227c

7.3 bd22f7e63509fa758cf500d9af3e88a3d3df96be

View source announcement ↗