CVE-2026-23158: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23158 Overview

CVE-2026-23158 is a use-after-free vulnerability in the Linux kernel's gpio-virtuser driver. The flaw resides in the configfs release path, where the guard(mutex) macro protects the device structure. The device memory is freed before the guard cleanup runs, causing mutex_unlock() to operate on freed memory.

A local authenticated attacker with the ability to interact with the gpio-virtuser configfs interface can trigger the slab use-after-free condition. Successful exploitation can lead to kernel memory corruption, privilege escalation, or denial of service. The vulnerability is tracked under [CWE-416] and affects Linux kernel release candidates 6.19-rc1 through 6.19-rc7.

Critical Impact
Local attackers can trigger a slab use-after-free in the kernel, potentially enabling privilege escalation to root and full system compromise.

Affected Products

Linux kernel 6.19-rc1 through 6.19-rc7
Linux kernel builds with CONFIG_GPIO_VIRTUSER enabled
Distributions packaging the affected gpio-virtuser driver from mainline

Discovery Timeline

2026-02-14 - CVE-2026-23158 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-23158

Vulnerability Analysis

The vulnerability exists in gpio_virtuser_device_config_group_release(), the configfs release callback for the gpio-virtuser driver. The function uses the guard(mutex) macro to acquire and automatically release a mutex protecting the device structure. The cleanup attribute associated with guard(mutex) runs mutex_unlock() when the function returns.

The code path destroys the mutex with mutex_destroy() and frees the device structure with kfree() while still inside the guard(mutex) scope. Once the function returns, the compiler-inserted cleanup calls mutex_unlock(&dev->lock) on memory that has already been released to the slab allocator. This produces a classic slab use-after-free condition detectable by KASAN.

Local users who can write to the gpio-virtuser configfs hierarchy can trigger the release path and reach the vulnerable code. The CWE-416 classification confirms the use-after-free root cause.

Root Cause

The root cause is improper ordering of lifetime management against the scope-based cleanup mechanism introduced with guard(mutex). The cleanup helper assumes the protected object remains valid until scope exit. Destroying and freeing the device inside the same scope violates this invariant.

Attack Vector

Exploitation requires local access and permission to interact with the configfs entries exposed by the gpio-virtuser driver. An attacker triggers the release path by removing a configured virtual GPIO device, causing the kernel to operate on freed slab memory. Heap-spray techniques targeting the freed allocation can convert the use-after-free into arbitrary kernel write primitives.

The vulnerability requires no user interaction once an attacker holds local privileges sufficient to manipulate configfs. Refer to the upstream fix commits for the exact code transition that limits the mutex lifetime using scoped_guard().

Detection Methods for CVE-2026-23158

Indicators of Compromise

KASAN reports referencing gpio_virtuser_device_config_group_release with slab-use-after-free annotations
Kernel oops or panic messages naming mutex_unlock invoked from the gpio-virtuser release path
Unexpected processes interacting with /sys/kernel/config/gpio-sim/ or gpio-virtuser configfs directories from non-administrative users

Detection Strategies

Enable KASAN on test and pre-production kernels to surface use-after-free conditions in the gpio-virtuser driver
Audit kernel logs for crashes or warnings originating from drivers/gpio/gpio-virtuser.c
Monitor loaded kernel modules and confirm whether gpio-virtuser is required in production builds

Monitoring Recommendations

Collect dmesg and journalctl -k output centrally and alert on BUG: or KASAN: strings referencing GPIO subsystems
Track configfs mount points and the processes performing write operations against them
Inventory Linux hosts running 6.19-rc kernels and prioritize them for patching

How to Mitigate CVE-2026-23158

Immediate Actions Required

Apply the upstream fix from Kernel Git Commit 53ad4a9, Kernel Git Commit 7bec90f, or Kernel Git Commit 815a8e3
Restrict local access on systems running affected 6.19-rc kernels until patches are deployed
Verify whether CONFIG_GPIO_VIRTUSER is enabled and disable it if the driver is not required

Patch Information

The upstream patch limits the mutex lifetime by wrapping only the activation check inside a scoped_guard() block. The lock releases before mutex_destroy() and kfree() execute, eliminating the use-after-free. Distribution maintainers should backport the fix to any 6.19-rc-based kernels they ship.

Workarounds

Unload the gpio-virtuser module on systems where it is not in active use: modprobe -r gpio-virtuser
Tighten filesystem permissions on the configfs mount to prevent unprivileged write access
Rebuild the kernel with CONFIG_GPIO_VIRTUSER=n for production deployments that do not require virtual GPIO testing

bash

# Configuration example
# Verify whether the vulnerable driver is loaded
lsmod | grep gpio_virtuser

# Remove the module if not required
sudo modprobe -r gpio-virtuser

# Confirm configfs access restrictions
mount | grep configfs