CVE-2026-22986— gpiolib: fix race condition for gdev->srcu
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-22986
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
gpiolib: fix race condition for gdev->srcu
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix race condition for gdev->srcu If two drivers were calling gpiochip_add_data_with_key(), one may be traversing the srcu-protected list in gpio_name_to_desc(), meanwhile other has just added its gdev in gpiodev_add_to_list_unlocked(). This creates a non-mutexed and non-protected timeframe, when one instance is dereferencing and using &gdev->srcu, before the other has initialized it, resulting in crash: [ 4.935481] Unable to handle kernel paging request at virtual address ffff800272bcc000 [ 4.943396] Mem abort info: [ 4.943400] ESR = 0x0000000096000005 [ 4.943403] EC = 0x25: DABT (current EL), IL = 32 bits [ 4.943407] SET = 0, FnV = 0 [ 4.943410] EA = 0, S1PTW = 0 [ 4.943413] FSC = 0x05: level 1 translation fault [ 4.943416] Data abort info: [ 4.943418] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 4.946220] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 4.955261] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 4.955268] swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000038e6c000 [ 4.961449] [ffff800272bcc000] pgd=0000000000000000 [ 4.969203] , p4d=1000000039739003 [ 4.979730] , pud=0000000000000000 [ 4.980210] phandle (CPU): 0x0000005e, phandle (BE): 0x5e000000 for node "reset" [ 4.991736] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP ... [ 5.121359] pc : __srcu_read_lock+0x44/0x98 [ 5.131091] lr : gpio_name_to_desc+0x60/0x1a0 [ 5.153671] sp : ffff8000833bb430 [ 5.298440] [ 5.298443] Call trace: [ 5.298445] __srcu_read_lock+0x44/0x98 [ 5.309484] gpio_name_to_desc+0x60/0x1a0 [ 5.320692] gpiochip_add_data_with_key+0x488/0xf00 5.946419] ---[ end trace 0000000000000000 ]--- Move initialization code for gdev fields before it is added to gpio_devices, with adjacent initialization code. Adjust goto statements to reflect modified order of operations [Bartosz: fixed a build issue, removed stray newline]
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于gdev->srcu存在竞争条件，可能导致崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-22986
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-22986
请登录查看更多情报信息。
Same Patch Batch · Linux · 2026-01-23 · 34 CVEs total
| CVE-2026-22984 | 9.8 CRITICAL | libceph: prevent potential out-of-bounds reads in handle_auth_done() |
| CVE-2026-22980 | 7.8 HIGH | nfsd: provide locking for v4_end_grace |
| CVE-2026-22988 | 7.8 HIGH | arp: do not assume dev_hard_header() does not change skb->head |
| CVE-2026-22992 | 7.5 HIGH | libceph: return the handler error from mon_handle_auth_done() |
| CVE-2026-22991 | 7.5 HIGH | libceph: make free_choose_arg_map() resilient to partial allocation |
| CVE-2026-22990 | 7.5 HIGH | libceph: replace overzealous BUG_ON in osdmap_apply_incremental() |
| CVE-2026-22979 | net: fix memory leak in skb_segment_list for GRO packets | |
| CVE-2026-22978 | wifi: avoid kernel-infoleak from struct iw_point | |
| CVE-2026-22981 | idpf: detach and close netdevs while handling a reset | |
| CVE-2026-22982 | net: mscc: ocelot: Fix crash when adding interface under a lag | |
| CVE-2026-22983 | net: do not write to msg_get_inq in callee | |
| CVE-2026-22985 | idpf: Fix RSS LUT NULL pointer crash on early ethtool operations | |
| CVE-2026-22987 | net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy | |
| CVE-2026-22989 | nfsd: check that server is running in unlock_filesystem | |
| CVE-2026-22993 | idpf: Fix RSS LUT NULL ptr issue after soft reset | |
| CVE-2026-22994 | bpf: Fix reference count leak in bpf_prog_test_run_xdp() | |
| CVE-2026-22995 | ublk: fix use-after-free in ublk_partition_scan_work | |
| CVE-2025-71145 | usb: phy: isp1301: fix non-OF device reference imbalance | |
| CVE-2025-71161 | dm-verity: disable recursive forward error correction | |
| CVE-2025-71160 | netfilter: nf_tables: avoid chain re-validation if possible |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2026-22986
No comments yet