Review reviewHigh

CVE-2026-64023

Linux

In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: fix a potential use-after-free On error we free aggr->lookups->dev_id before removing the entry from the lookup table. If a concurrent thread calls gpiod_find() before we remove the entry, it could iterate over the list and call gpiod_match_lookup_table() which unconditionally dereferences dev_id when calling strcmp(). Reverse the order of cleanup.

CVSS: 7.8
EPSS: -
CISA KEV: Not listed
Published: 2026.07.20

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8 < ea28b286649b70618e9dd3e895812417a7712a11, >= 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8 < 7ac4183a41ba048af89eddd82fe8be64619d0871, >= 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8 < 30c073cab97afb31901f94de9605177b6b84367e, >= 6.16
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: Not available