CVE-2026-99050
- Source
- https://cve.org/CVERecord?id=CVE-2026-99050
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-99050.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-99050
- Downstream
- Published
- 2026-10-23T12:22:29Z
- Modified
- 2026-11-13T04:07:33Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- gpio: mpsse: fix race when arming the IRQ poll worker
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
gpio: mpsse: fix race when arming the IRQ poll worker
gpio_mpsse_irq_enable() arms the poll worker before publishing it: schedule_work() runs before the worker is added to priv->workers. If gpio_mpsse_disconnect() walks the list in that window it misses the worker, and once disconnect returns, the USB core frees mpsse_priv while the orphaned gpio_mpsse_poll() work keeps accessing it, causing a use-after-free.
Fix this by publishing and arming the worker in one irq_spin critical section. Teardown walks the same list under irq_spin, so a worker found on the list is guaranteed to be armed, and cancel_work_sync() handles it whether it is queued or running.
A worker armed after the disconnect walk would still be missed, so also set a new priv->dying flag under irq_spin before the teardown walk, and check it in the same critical section, freeing it via kfree_rcu() instead when the device is going away, since kfree() would be called with the IRQ core's raw spinlock held and may sleep on PREEMPT_RT. schedule_work() is safe to call with irq_spin held, and the next probe gets a fresh mpsse_priv, so the flag never needs to be cleared.
This issue was found by an in-house static analysis tool.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99050.json" }- References
-
- https://git.kernel.org/stable/c/76390ac0bca7e5058b7482eb4d951c3bda5df812
- https://git.kernel.org/stable/c/7efa1a1953cd6b20b23a3524d5b4b81789c6ef25
- https://git.kernel.org/stable/c/c0071ee496e1228976c72b096f529503222708a0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99050.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-99050
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced472d900c8bcac301ae0e40fdca7db799bd989ff5Fixed76390ac0bca7e5058b7482eb4d951c3bda5df812
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced179ef1127d7a4f09f0e741fa9f30b8a8e7886271Fixedc0071ee496e1228976c72b096f529503222708a0Fixed7efa1a1953cd6b20b23a3524d5b4b81789c6ef25