CVE-2026-23015: Linux Kernel GPIO Reference Leak Flaw

CVE-2026-23015 Overview

A reference leak vulnerability has been identified in the Linux kernel's GPIO MPSSE (Multi-Protocol Synchronous Serial Engine) driver. The vulnerability exists in the gpio_mpsse_probe() function where a USB device reference obtained through usb_get_dev() is not properly released in error handling paths, leading to a memory leak condition.

Critical Impact
This vulnerability can lead to resource exhaustion through memory leaks when USB device probing fails repeatedly, potentially causing system instability or denial of service conditions on affected Linux systems.

Affected Products

Linux kernel with GPIO MPSSE driver enabled
Systems using USB FTDI MPSSE-capable devices for GPIO operations
Embedded Linux systems utilizing MPSSE hardware interfaces

Discovery Timeline

2026-01-31 - CVE CVE-2026-23015 published to NVD
2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-23015

Vulnerability Analysis

This vulnerability is classified as a Memory Leak issue within the Linux kernel's GPIO subsystem. The gpio_mpsse_probe() function is responsible for initializing GPIO MPSSE hardware during device enumeration. When the function calls usb_get_dev(), it increments the reference count on the USB device structure to ensure the device remains valid during the probe operation.

The core issue arises when the probe function encounters an error condition after successfully obtaining the USB device reference. In such scenarios, the error handling code paths fail to call the corresponding usb_put_dev() function, leaving the reference count elevated. Over time, especially in scenarios involving repeated device insertion/removal or probe failures, this can result in accumulated memory allocations that are never freed.

Root Cause

The root cause is improper resource management in the gpio_mpsse_probe() error paths. The function correctly obtains a reference to the USB device using usb_get_dev() but does not implement proper cleanup when subsequent initialization steps fail. The fix involves converting to device-managed helper functions (devm_* APIs) which automatically handle resource cleanup when the device is removed or when probe fails, eliminating the need for manual reference management in error paths.

Attack Vector

The attack vector for this vulnerability requires local access to a system with the GPIO MPSSE driver loaded. An attacker could potentially trigger repeated probe failures by:

Repeatedly connecting and disconnecting USB MPSSE devices
Manipulating USB device descriptors to cause probe failures
Exploiting conditions that cause the probe function to fail after usb_get_dev() is called

The vulnerability mechanism involves the kernel's USB subsystem reference counting. When usb_get_dev() is called, it increments the device's reference count. Each unreleased reference prevents the USB device structure from being freed, consuming kernel memory. The fix implements device-managed resources that automatically release references when the device is unbound or when probe fails.

Detection Methods for CVE-2026-23015

Indicators of Compromise

Unexpected growth in kernel memory usage, particularly in USB subsystem allocations
Increased count of USB device reference objects that are not being freed
System logs showing repeated GPIO MPSSE probe failures without corresponding cleanup
Memory pressure warnings in kernel logs on systems with MPSSE hardware

Detection Strategies

Monitor /proc/slabinfo for growing USB-related slab allocations
Use kernel memory debugging tools like kmemleak to identify unreleased USB device references
Track dmesg output for GPIO MPSSE probe error messages
Implement monitoring for abnormal kernel memory consumption patterns

Monitoring Recommendations

Enable kernel memory leak detection (CONFIG_DEBUG_KMEMLEAK) on development and testing systems
Monitor system memory utilization trends on systems with USB MPSSE hardware
Review kernel logs for GPIO MPSSE driver initialization errors
Use tracing tools to monitor USB device reference count changes

How to Mitigate CVE-2026-23015

Immediate Actions Required

Update to a patched Linux kernel version that includes the fix
If updates are not immediately possible, consider unloading the gpio-mpsse module if not actively required
Monitor affected systems for signs of memory exhaustion
Limit physical USB access to trusted personnel on critical systems

Patch Information

The vulnerability has been addressed in the Linux kernel through commits that implement device-managed helper functions for proper resource cleanup. The fix removes manual usb_put_dev() calls from the disconnect function since resources are now automatically released through the device-managed framework.

Patches are available through the following kernel git commits:

Workarounds

Disable or unload the gpio-mpsse kernel module if MPSSE GPIO functionality is not required
Restrict physical access to USB ports on affected systems
Implement USB device authorization policies to prevent unauthorized device connections
Monitor and restart affected systems if memory pressure is detected

bash

# Unload gpio-mpsse module if not required
sudo modprobe -r gpio-mpsse

# Blacklist the module to prevent automatic loading
echo "blacklist gpio-mpsse" | sudo tee /etc/modprobe.d/blacklist-gpio-mpsse.conf

# Verify module is not loaded
lsmod | grep gpio_mpsse