CVE-2026-80563

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind

The "trigger" debugfs file has a hand-rolled ->write handler

(trigger_write()) that dereferences the per-device gpio_la_poll_priv. The

file is created with debugfs_create_file_unsafe(), and the handler never

takes a debugfs reference. Nothing keeps the object alive while the

handler runs.

priv is allocated with devm_kzalloc(). devres frees it when the platform

device is unbound. debugfs_create_file_unsafe() installs no full_proxy

wrapper, so debugfs_remove_recursive() in gpio_la_poll_remove() does not

wait for an in-flight trigger_write(). The blob_lock taken there does not

help, because trigger_write() never takes it. A write that races an unbind

therefore writes into freed memory:

trigger_write() gpio_la_poll_remove()

priv = m->private

buf = memdup_user() [may sleep]

mutex

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References