CVE-2026-80563: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80563 Overview

CVE-2026-80563 is a use-after-free vulnerability in the Linux kernel's gpio-sloppy-logic-analyzer driver. The flaw exists in the trigger debugfs file's hand-rolled ->write handler (trigger_write()), which dereferences per-device state (gpio_la_poll_priv) without holding a debugfs reference. Because the file is created with debugfs_create_file_unsafe(), no full_proxy wrapper drains in-flight writes when the platform device is unbound. A root-triggered unbind racing a concurrent write results in a write into freed memory. The issue has been resolved upstream by switching to debugfs_create_file().

Critical Impact
A local privileged user can trigger a slab-use-after-free write in kernel memory by racing a trigger debugfs write against a driver unbind, enabling potential memory corruption and kernel compromise.

Affected Products

Linux kernel builds enabling the gpio-sloppy-logic-analyzer driver
Stable kernel branches prior to the fix commits 23e9f32c0c7d, 24bef4918f6a, 44f3468a0aef, and 49a1ebb1ef2c
Systems exposing /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind to root-accessible tooling

Discovery Timeline

2026-08-26 - CVE-2026-80563 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-80563

Vulnerability Analysis

The gpio-sloppy-logic-analyzer driver exposes a trigger file under debugfs. The custom trigger_write() handler reads user data with memdup_user(), which may sleep, then stores the buffer pointer and length into the driver's private structure priv. That priv object is allocated with devm_kzalloc(), so devres frees it as soon as the platform device is unbound.

Because the file was created with debugfs_create_file_unsafe(), debugfs does not install its full_proxy wrapper. As a result, debugfs_remove_recursive() inside gpio_la_poll_remove() does not wait for in-flight ->write calls to finish. The blob_lock acquired during removal offers no protection, because trigger_write() never takes it.

Root Cause

The root cause is a lifetime mismatch between the debugfs file handler and the object it dereferences [CWE-416]. Two independent decisions combine to create the flaw: using debugfs_create_file_unsafe(), which skips reference-counted proxying, and using devm_kzalloc(), which ties priv's lifetime to device binding. Neither the handler nor the removal path synchronizes with the other, leaving a window where priv is freed while trigger_write() still holds a stale pointer.

Attack Vector

An attacker with root access races a write to the trigger debugfs file against an unbind of the driver via /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind. While trigger_write() blocks inside memdup_user(), the unbind path completes debugfs_remove_recursive() and devres frees priv. Execution then resumes in the handler and assigns priv->trig_data and priv->trig_len on freed slab memory. KASAN reports a slab-use-after-free write in the handler when reproduced. Because the trigger requires root and physical or platform-level driver access, exploitation is local rather than remote.

Code examples are not published as verified proof-of-concept artifacts; see the Kernel Git Commit 23e9f32 for the authoritative fix.

Detection Methods for CVE-2026-80563

Indicators of Compromise

KASAN reports containing BUG: KASAN: slab-use-after-free in trigger_write on affected kernels
Kernel oops or panic traces referencing gpio_la_poll_priv, trigger_write, or gpio_la_poll_remove
Unexpected writes to /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind correlated with concurrent activity on the driver's trigger debugfs file

Detection Strategies

Enable KASAN on test and pre-production kernels to catch slab-use-after-free writes originating in the gpio-sloppy-logic-analyzer driver.
Audit kernel build configuration to determine whether CONFIG_GPIO_SLOPPY_LOGIC_ANALYZER is enabled and whether debugfs is mounted in production.
Monitor auditd or eBPF telemetry for opens of files under debugfs/gpio-sloppy-logic-analyzer/ and writes to platform driver unbind sysfs entries.

Monitoring Recommendations

Alert on root-level processes writing to /sys/bus/platform/drivers/*/unbind, particularly on systems where administrative unbind is not part of normal operations.
Track kernel ring buffer messages for KASAN, BUG:, and WARNING: entries referencing GPIO or debugfs subsystems.
Correlate driver load, bind, and unbind events with debugfs file access to identify race attempts.

How to Mitigate CVE-2026-80563

Immediate Actions Required

Apply the upstream fix that replaces debugfs_create_file_unsafe() with debugfs_create_file() for the trigger file, ensuring debugfs_remove_recursive() drains in-flight writes.
Update to a stable kernel that incorporates commits 23e9f32c0c7d, 24bef4918f6a, 44f3468a0aef, or 49a1ebb1ef2c.
Restrict root access on systems that expose the gpio-sloppy-logic-analyzer driver and debugfs.

Patch Information

The fix is available in the upstream Linux kernel across multiple stable branches. Review the patches at Kernel Git Commit 23e9f32, Kernel Git Commit 24bef49, Kernel Git Commit 44f3468, and Kernel Git Commit 49a1ebb. Distribution vendors will rebase these commits into their maintained kernels; monitor your distribution's security advisories for backported packages.

Workarounds

Disable the gpio-sloppy-logic-analyzer driver by not loading its module or rebuilding the kernel with CONFIG_GPIO_SLOPPY_LOGIC_ANALYZER unset if it is not required.
Unmount or restrict access to debugfs in production, since debugfs is a debugging interface and generally not required at runtime.
Remove or tightly control write permissions on /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind through kernel lockdown or reduced privilege sets.

bash

# Configuration example: disable debugfs mount and confirm driver status
# 1. Verify whether the vulnerable driver is present
grep GPIO_SLOPPY_LOGIC_ANALYZER /boot/config-$(uname -r)

# 2. Prevent module autoload as a temporary mitigation
echo 'blacklist gpio-sloppy-logic-analyzer' | sudo tee /etc/modprobe.d/blacklist-gpio-sla.conf

# 3. Ensure debugfs is not world-accessible if mounted
mount | grep debugfs
sudo chmod 700 /sys/kernel/debug