CVE-2026-80563

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind<br /> <br /> The "trigger" debugfs file has a hand-rolled -&gt;write handler<br /> (trigger_write()) that dereferences the per-device gpio_la_poll_priv. The<br /> file is created with debugfs_create_file_unsafe(), and the handler never<br /> takes a debugfs reference. Nothing keeps the object alive while the<br /> handler runs.<br /> <br /> priv is allocated with devm_kzalloc(). devres frees it when the platform<br /> device is unbound. debugfs_create_file_unsafe() installs no full_proxy<br /> wrapper, so debugfs_remove_recursive() in gpio_la_poll_remove() does not<br /> wait for an in-flight trigger_write(). The blob_lock taken there does not<br /> help, because trigger_write() never takes it. A write that races an unbind<br /> therefore writes into freed memory:<br /> <br /> trigger_write() gpio_la_poll_remove()<br /> priv = m-&gt;private<br /> buf = memdup_user() [may sleep]<br /> mutex_lock(&amp;priv-&gt;blob_lock)<br /> debugfs_remove_recursive() [no wait]<br /> mutex_unlock(&amp;priv-&gt;blob_lock)<br /> (remove returns; devres frees priv)<br /> priv-&gt;trig_data = buf trig_len = count<br /> <br /> The race is reachable by root via<br /> /sys/bus/platform/drivers/gpio-sloppy-logic-analyzer/unbind.<br /> <br /> Create "trigger" with debugfs_create_file() instead. Its full_proxy<br /> wrapper makes debugfs_remove_recursive() drain any in-flight -&gt;write<br /> before it returns.<br /> <br /> The use-after-free is confirmed under KASAN with a minimal reproducer of<br /> the same debugfs_create_file_unsafe() plus devm_kzalloc() pattern<br /> (available on request); it produces a slab-use-after-free write in the<br /> handler.