CVE-2026-43138 Details
Description
In the Linux kernel, the following vulnerability has been resolved: reset: gpio: suppress bind attributes in sysfs This is a special device that's created dynamically and is supposed to stay in memory forever. We also currently don't have a devlink between it and the actual reset consumer. Suppress sysfs bind attributes so that user-space can't unbind the device because - as of now - it will cause a use-after-free splat from any user that puts the reset control handle.
A vulnerability exists in the Linux kernel's GPIO-based reset controller, where the sysfs bind attributes are not properly managed. This issue can lead to a use-after-free error, causing a kernel crash. The vulnerability arises because the reset device, which is dynamically created and intended to remain in memory indefinitely, lacks a proper connection to its reset consumer. As a result, user-space can inadvertently unbind the device, triggering the use-after-free condition.
The vulnerability has been addressed by adding a suppression for the bind attributes in the sysfs, preventing user-space from unbinding the reset device. Users should update to the latest version of the Linux kernel where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/09d6efc6abd42809956d598906c222ccd1c8ae92 | kernel.org | Patch |
| https://git.kernel.org/stable/c/16de4c6a8fe9ff497ca1aba33ef0dbee09f11952 | kernel.org | Patch |
| https://git.kernel.org/stable/c/1d7d869f074f98c34fe23f6a56e5f3acc1f95a2b | kernel.org | Patch |
| https://git.kernel.org/stable/c/76801c3dfca0ac6339a23e9615b5f23e25b8644c | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.9, < 6.12.75 >= 6.13, < 6.18.16 >= 6.19, < 6.19.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 12, 2026 | Initial Analysis | [email protected] |
| May 6, 2026 | New CVE Received | kernel.org |