Riskcovery

CVE-2026-99190

gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths

State
Published
Severity
Not scored
Published
Oct 28, 2026
Updated
Oct 30, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths

A drive-by review by Sashiko reports that, after a failed call to gpiochip_set_multiple(), gpiod_set_array_value() returns abruptly, bypassing the freeing of possibly alloced bitmaps, potentially leaking memory. It is an unlikely error path, but is possible.

Defer the return code check until after the bitmap_free() block.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d73d2a569e6212f58d89efc6e66ffbb2386a47b1 to before 68a2cd5381b8d89dc80bd16dd9cc9ca2d5c25e7fAffected
  • 9b407312755fd5db012413ca005f0f3a661db8dd to before 78189c0e35abbcdab3b8ab0b764d578c02900734Affected
  • 9b407312755fd5db012413ca005f0f3a661db8dd to before 890c3bf08e0fc09eff788a6cfeded7d21b4d3e9dAffected
  • 9b407312755fd5db012413ca005f0f3a661db8dd to before c28846ca1ac6134881114d272314623c8433e372Affected
  • 6.12.114 to before 6.12.115Affected
LinuxLinux
  • 6.15Affected
  • before 6.15Not affected
  • 6.12.115 through 6.12.*Not affected
  • 6.18.59 through 6.18.*Not affected
  • 7.2.13 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.