CVE-2026-64022 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
gpio: aggregator: remove the software node when deactivating the aggregator
The dynamic software node we create for the aggregator platform device when using configfs is leaked when the device is deactivated. Destroy it as the last step in the tear-down path.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides within the Linux kernel's gpio subsystem, specifically affecting the gpio aggregator functionality that operates through configfs interfaces. The issue manifests as a resource leak where dynamic software nodes associated with aggregator platform devices are not properly cleaned up during device deactivation cycles. When userspace interacts with gpio aggregators via configfs, the kernel creates temporary software nodes to represent these virtual devices, but fails to destroy them appropriately when the aggregator is shut down or deactivated. This represents a classic memory management flaw that can accumulate over time, leading to progressive resource exhaustion and potential system instability.
The technical root cause stems from improper device teardown sequencing within the gpio aggregator subsystem where the software node destruction occurs at an incorrect phase in the deactivation process. According to CWE-404, this vulnerability maps directly to improper resource release or cleanup, specifically involving the failure to properly dispose of dynamically allocated resources during system shutdown or device removal operations. The flaw exists in the platform device management logic where the software node is created but not destroyed in the final step of the tear-down sequence, creating a persistent memory leak that can grow with repeated activation and deactivation cycles.
The operational impact of this vulnerability extends beyond simple resource consumption, potentially affecting system reliability and performance over extended periods of operation. As the leaked software nodes accumulate, they consume kernel memory resources that could otherwise be utilized for legitimate system operations, gradually reducing available memory for other critical subsystems. This can lead to system slowdowns, increased latency in gpio operations, or even complete system instability if memory exhaustion occurs during critical operations. The vulnerability is particularly concerning in embedded systems or environments where gpio aggregators are frequently activated and deactivated, as the leak compounds over time.
Mitigation strategies should focus on implementing proper resource cleanup within the device deactivation path, ensuring that all dynamically created software nodes are destroyed as the final step in the teardown sequence. System administrators should monitor for memory usage patterns and consider implementing periodic restarts of gpio-related services to prevent accumulation of leaked resources. The fix aligns with ATT&CK technique T1490 which involves resource exhaustion attacks, where improper cleanup can create conditions that lead to system instability or denial of service scenarios. Additionally, this vulnerability highlights the importance of proper software node management in kernel subsystems and underscores the necessity of comprehensive testing for resource lifecycle management in complex device driver frameworks.