Linux kernel gpio-mpsse driver: Use-after-free in IRQ poll worker teardown
Summary
A race condition in the gpio-mpsse driver, which provides GPIO support for FTDI MPSSE adapters, can lead to a use-after-free when a USB MPSSE device is disconnected while the IRQ poll worker is being armed. The freed memory may still be accessed by the orphaned poll worker, which can corrupt memory or crash the system. Exploitation requires a local user or process with access to USB hardware and an attached MPSSE device; the vulnerability is not network-reachable.
Affected
- Linux kernel versions with the gpio-mpsse driver before the fix commits, per the kernel CNA record; ranges differ between sources.
- Per the CNA record: 6.18.6 to before 6.18.57, and 6.19 before the fixed release.
- Exact affected and fixed versions are unconfirmed; verify against kernel.org and your distribution's kernel advisory.
Fixed in
- Stable fix commits: 76390ac0bca7e5058b7482eb4d951c3bda5df812, 7efa1a1953cd6b20b23a3524d5b4b81789c6ef25, c0071ee496e1228976c72b096f529503222708a0.
- OSV lists fixed versions 6.18.57 and 7.2.11.
- Confirm the fixed release for your branch in the stable-kernel release notes.
Workaround
- No vendor workaround found.
- Interim measure (not from a source): on hosts that do not need FTDI MPSSE adapters, blacklist the gpio-mpsse module.
- Restrict USB access to trusted devices.
Exploitation
- CISA KEV: not listed.
- No public exploit known; VulDB reports no exploit available.
- OffSeq reports not known to be exploited. EPSS: 0.00157.
Our recommendation
- Update the Linux kernel to a stable release containing the fix on hosts that use the gpio-mpsse driver.
- Check whether FTDI MPSSE GPIO, SPI or I2C adapters are in use, for example on engineering, lab or test systems.
- Blacklist gpio-mpsse where the driver is not needed and restrict USB access.
- Prioritise as a regular kernel update, not an emergency.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable fix commit 76390ac0 git.kernel.org
- Linux kernel stable fix commit 7efa1a19 git.kernel.org
- Linux kernel stable fix commit c0071ee4 git.kernel.org
- SUSE CVE entry (Vulners) vulners.com
- Ubuntu CVE tracker ubuntu.com
- SUSE CVE page www.suse.com
- VulDB entry vuldb.com
- OffSeq threat radar radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:24.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_enable() arms the poll worker before publishing it: schedule_work() runs before the worker is added to priv->workers. If gpio_mpsse_disconnect() walks the list in that window it misses the worker, and once disconnect returns, the USB core frees mpsse_priv while the orphaned gpio_mpsse_poll() work keeps accessing it, causing a use-after-free. Fix this by publishing and arming the worker in one irq_spin critical section. Teardown walks the same list under irq_spin, so a worker found on the list is guaranteed to be armed, and cancel_work_sync() handles it whether it is queued or running. A worker armed after the disconnect walk would still be missed, so also set a new priv->dying flag under irq_spin before the teardown walk, and check it in the same critical section, freeing it via kfree_rcu() instead when the device is going away, since kfree() would be called with the IRQ core's raw spinlock held and may sleep on PREEMPT_RT. schedule_work() is safe to call with irq_spin held, and the next probe gets a fresh mpsse_priv, so the flag never needs to be cleared. This issue was found by an in-house static analysis tool.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.