{"id":"CVE-2026-98971","published":"2026-10-23T13:17:18.673","lastModified":"2026-10-23T13:17:18.673","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: exar: initialize the ID before registering its cleanup\n\ndevm_add_action_or_reset() invokes the cleanup action immediately when\nregistering the action fails.  gpio_exar_probe() currently stores the\nallocated ID in exar_gpio only after registering the action, so that\nfailure makes exar_devm_ida_free() release ID 0.  If the allocated ID is\nnonzero, this leaks that ID and can free ID 0 belonging to another device.\n\nStore the ID before registering the cleanup action so both the immediate\nfailure path and normal device teardown release the correct allocation.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/01318927a9055136c207399eeb36ce07becac179","tags":[]},{"url":"https://git.kernel.org/stable/c/4d69e74034b208588636ecc177e0dd43a7696af3","tags":[]},{"url":"https://git.kernel.org/stable/c/b78c114600ae3df90c083c72c290437b068577c8","tags":[]},{"url":"https://git.kernel.org/stable/c/bf3d841ef12fcbec4458e2750956b738b043a226","tags":[]},{"url":"https://git.kernel.org/stable/c/f7ec4dbd2a073dd53b6349be1c586fe8580dd6b2","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}