CVE-2026-22986 — Race Condition in Linux
Severity
4.7MEDIUMNVD
EPSS
0.0%
top 97.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 23
Description
In the Linux kernel, the following vulnerability has been resolved:
gpiolib: fix race condition for gdev->srcu
If two drivers were calling gpiochip_add_data_with_key(), one may be
traversing the srcu-protected list in gpio_name_to_desc(), meanwhile
other has just added its gdev in gpiodev_add_to_list_unlocked().
This creates a non-mutexed and non-protected timeframe, when one
instance is dereferencing and using &gdev->srcu, before the other
has initialized it, resulting in crash:
[ 4.935481] …
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.0 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linux47d8b4c1d868148c8fb51b785a89e58ca2d02c4d — fb674c8f1a5d8dd3113a7326030f963fa2d79c02+2
Patches
🔴Vulnerability Details
2OSV▶
CVE-2026-22986: In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix race condition for gdev->srcu If two drivers were calling gpiochip_ad↗2026-01-23
GHSA▶
GHSA-c2vw-8m72-w2vh: In the Linux kernel, the following vulnerability has been resolved:
gpiolib: fix race condition for gdev->srcu
If two drivers were calling gpiochip_↗2026-01-23