← CVE announcements

SECURITY ANNOUNCEMENT

CVE-2026-99190

28 October 2026

A drive-by review by Sashiko reports that, after a failed call to gpiochip_set_multiple(), gpiod_set_array_value() returns abruptly, bypassing the freeing of possibly alloced bitmaps, potentially leaking memory. It is an unlikely error path, but is possible.

Defer the return code check until after the bitmap_free() block.

Introduced

6.15 9b407312755fd5db012413ca005f0f3a661db8dd

Fixed releases

6.18.59 78189c0e35abbcdab3b8ab0b764d578c02900734

7.2.13 890c3bf08e0fc09eff788a6cfeded7d21b4d3e9d

7.3 c28846ca1ac6134881114d272314623c8433e372

View source announcement ↗