CVE-2026-98528: Linux Kernel GPIO Information Disclosure

CVE-2026-98528 Overview

CVE-2026-98528 is a kernel information disclosure vulnerability in the Linux kernel's GPIO character device (gpio: cdev) subsystem. The flaw resides in the error path of gpio_desc_to_lineinfo(), which returns to the caller before zeroing a stack-allocated info struct that is later copied to user-space through lineinfo_get_v1(). When acquisition of the GPIO chip guard fails, uninitialized kernel stack contents can be returned to an unprivileged caller. The upstream fix changes gpio_desc_to_lineinfo() to return int so the -ENODEV from the failed guard acquisition is propagated, and moves the memset() before the SRCU read lock acquisition.

Critical Impact
Local users with access to the GPIO character device can leak uninitialized kernel stack memory, potentially exposing pointers, secrets, or data useful for bypassing KASLR.

Affected Products

Linux kernel GPIO character device subsystem (drivers/gpio/gpiolib-cdev.c)
Linux stable branches referenced by commits 1feb5d3, 60a466f, 8460ee5, and cf3d043
Distributions shipping affected stable kernels prior to backporting the fix

Discovery Timeline

2026-10-18 - CVE-2026-98528 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98528

Vulnerability Analysis

The vulnerability is an information disclosure caused by uninitialized memory use [CWE-908] in the Linux kernel GPIO character device interface. User-space obtains per-line metadata through ioctls that eventually call lineinfo_get_v1(), which allocates a struct gpio_v2_line_info on the kernel stack and asks gpio_desc_to_lineinfo() to populate it.

In the error path, gpio_desc_to_lineinfo() returned early when it could not acquire the GPIO chip guard, without first zeroing the output struct. The caller previously had no way to detect this because the helper returned void. The stale stack contents were then copied to user-space, leaking whatever previous kernel function activations had left on the stack.

Root Cause

The root cause is an ordering defect in error handling. The memset() that initializes the info structure was placed after the guard acquisition, so a failed guard left the structure uninitialized. Compounding this, gpio_desc_to_lineinfo() returned void, preventing callers from distinguishing success from failure and reacting accordingly.

Attack Vector

Exploitation requires local access and permission to open a /dev/gpiochipN device. An attacker triggers the GPIO line-info ioctl under conditions that cause gpio_device_get_chip_guard() to fail, returning -ENODEV. Because the helper did not propagate this error and did not zero the struct, the subsequent copy_to_user() in lineinfo_get_v1() discloses kernel stack bytes. The leak can be used to defeat kernel address space layout randomization (KASLR) or to recover sensitive data left on the stack by earlier syscalls.

The vulnerability is described in prose only; see the upstream fixes in Kernel Git Commit 1feb5d3, Kernel Git Commit 60a466f, Kernel Git Commit 8460ee5, and Kernel Git Commit cf3d043.

Detection Methods for CVE-2026-98528

Indicators of Compromise

No network-observable indicators exist; exploitation is local and leaves minimal forensic traces.
Unexpected processes opening /dev/gpiochip* devices, especially from non-privileged or non-industrial workloads.
Repeated GPIO line-info ioctl calls (GPIO_V2_GET_LINEINFO_IOCTL) failing with -ENODEV in audit logs.

Detection Strategies

Enable Linux audit rules on /dev/gpiochip* opens and ioctl invocations to baseline legitimate GPIO users.
Correlate kernel log entries referencing GPIO chip removal or hot-unplug events with concurrent ioctl activity.
Review installed kernel versions against the fixed commits to identify unpatched hosts across the fleet.

Monitoring Recommendations

Track EPSS and vendor advisories; current EPSS for CVE-2026-98528 is 0.209%, indicating low near-term exploitation likelihood but non-zero risk.
Monitor distribution security trackers (Debian, Ubuntu, Red Hat, SUSE) for backport releases referencing the four upstream commits.
Alert on new userland binaries invoking GPIO ioctls on servers and workstations where GPIO is not a known workload.

How to Mitigate CVE-2026-98528

Immediate Actions Required

Inventory systems running kernels that expose /dev/gpiochip* and prioritize those with untrusted local users.
Apply vendor kernel updates that include the upstream fix for gpio_desc_to_lineinfo() as soon as they are available.
Restrict permissions on /dev/gpiochip* nodes to trusted groups and services only.

Patch Information

The fix is upstream in the Linux stable tree. Review Kernel Git Commit 1feb5d3, Kernel Git Commit 60a466f, Kernel Git Commit 8460ee5, and Kernel Git Commit cf3d043. The patch changes gpio_desc_to_lineinfo() to return int, propagates -ENODEV to callers, and moves the memset() of the info struct ahead of the SRCU read lock acquisition.

Workarounds

Remove or blacklist unneeded GPIO kernel modules on systems that do not require GPIO userspace access.
Tighten udev rules so that /dev/gpiochip* devices are owned by a dedicated group and are not world-readable.
Where feasible, use mandatory access control (SELinux or AppArmor) to deny GPIO ioctls to general-purpose users and containers.

bash

# Example udev rule to restrict GPIO character device access
# /etc/udev/rules.d/80-gpio.rules
SUBSYSTEM=="gpio", KERNEL=="gpiochip*", GROUP="gpio", MODE="0660"