CVE-2026-64022: Linux Kernel Information Disclosure Flaw

CVE-2026-64022 Overview

CVE-2026-64022 is a memory leak vulnerability in the Linux kernel's GPIO aggregator subsystem. The flaw resides in the aggregator driver's configfs deactivation path, where a dynamically allocated software node created for the aggregator platform device is not released when the device is deactivated. Repeated activation and deactivation cycles cause kernel memory to accumulate over time. Kernel maintainers resolved the issue by destroying the software node as the final step in the tear-down path.

Critical Impact
Repeated GPIO aggregator activation and deactivation through configfs leaks kernel memory, degrading system stability on long-running Linux hosts that expose the interface to privileged users.

Affected Products

Linux kernel builds that enable the gpio-aggregator driver with configfs support
Distributions shipping kernels prior to the fixes referenced in commits 3e657619cf72, 61fef83f239e, and 9870ea9a4a25
Embedded and industrial Linux systems that dynamically create GPIO aggregator devices at runtime

Discovery Timeline

2026-07-19 - CVE-2026-64022 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64022

Vulnerability Analysis

The Linux kernel gpio-aggregator driver lets administrators group GPIO lines from multiple controllers into a single virtual device. When configfs is used to create an aggregator, the driver allocates a dynamic software node describing the child device's properties. This node is attached to the aggregator platform device at activation.

The deactivation path unregisters the platform device but does not free the associated software node. The allocated fwnode structure and its property array remain in kernel memory after the aggregator is torn down. Each activation and deactivation cycle leaks another allocation.

Over time this exhausts kernel slab memory on long-running systems. Because configfs interaction requires root privileges, the vulnerability is primarily a stability and resource-exhaustion concern rather than a remote attack vector.

Root Cause

The root cause is an incomplete tear-down sequence in the aggregator driver. The activation path calls fwnode_create_software_node() to build the descriptor, but the corresponding deactivation logic omits fwnode_remove_software_node(). The fix adds this call as the final step of the tear-down path, ensuring the node is destroyed after the platform device is unregistered.

Attack Vector

The issue is triggered locally by a privileged user with write access to the GPIO aggregator configfs interface, typically mounted under /sys/kernel/config/gpio-aggregator/. Scripts or orchestration systems that repeatedly create and destroy aggregator devices amplify the leak. There is no network-facing attack surface.

The vulnerability manifests in the aggregator deactivation function. See the referenced kernel commits for the exact patch context and diff.

Detection Methods for CVE-2026-64022

Indicators of Compromise

Steady growth in kernel slab allocations attributable to kmalloc and fwnode caches on systems that use the GPIO aggregator
Increasing count of orphaned software nodes visible through /sys/kernel/debug/ when debugfs is available
Unexpected kernel memory pressure or OOM events on embedded devices that repeatedly reconfigure GPIO aggregators

Detection Strategies

Audit installed kernel versions against the fixed commits 3e657619cf72, 61fef83f239e, and 9870ea9a4a25 using package inventory tooling
Monitor /proc/slabinfo for growth in generic kmalloc slabs on hosts that exercise the aggregator interface
Correlate configfs write activity under gpio-aggregator/ with kernel memory usage trends to identify vulnerable behavior

Monitoring Recommendations

Alert on repeated mkdir and rmdir operations under the GPIO aggregator configfs path from non-standard processes
Track MemAvailable and slab statistics on long-running industrial or IoT Linux nodes and flag sustained decline
Log kernel version and patch level as part of standard host telemetry so unpatched systems can be identified quickly

How to Mitigate CVE-2026-64022

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 3e657619cf72, 61fef83f239e, and 9870ea9a4a25 and reboot affected hosts
Restrict write access to /sys/kernel/config/gpio-aggregator/ to trusted administrators only
Reboot long-running systems that have exercised the aggregator interface heavily to reclaim leaked kernel memory

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Refer to the gpio-aggregator tear-down fix (3e657619), stable backport (61fef83f), and stable backport (9870ea9a) for the exact changes. Distribution vendors should pull these commits into their supported kernel branches.

Workarounds

Unload the gpio-aggregator module on systems that do not require it using modprobe -r gpio-aggregator
Avoid repeated create-and-destroy cycles of aggregator devices in automation scripts until the kernel is patched
Schedule periodic reboots of affected embedded systems to bound accumulated memory loss until patches are deployed

bash

# Configuration example
# Remove the vulnerable module when not required
sudo modprobe -r gpio-aggregator

# Blacklist to prevent automatic reload on boot
echo 'blacklist gpio-aggregator' | sudo tee /etc/modprobe.d/gpio-aggregator.conf