CVE-2026-31732: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31732 is a resource leak vulnerability in the Linux kernel's GPIO subsystem, specifically in the gpiochip_add_data_with_key() function. Since commit aab5c6f20023 ("gpio: set device type for GPIO chips"), the gdev->dev.release handler was left unset, causing the reference count to gdev->dev not to be dropped on error handling paths — potentially leading to memory exhaustion and system crash. The vulnerability affects Linux kernel versions 6.9 through 6.18.21 and 6.19 through 6.19.11, as well as pre-release 7.0 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-911 (Improper Update of Reference Count) and CWE-401 (Missing Release of Memory after Effective Lifetime). After device_initialize() is called in gpiochip_add_data_with_key(), the gpiodev_release() function is expected to take over resource cleanup; however, because gdev->dev.release was unset, error paths fail to call gpio_device_put(), leaving device references and associated memory unreleased. Additionally, the flawed error-handling structure could cause certain paths to re-enter ERR ZONE 1 after device_initialize(), risking a double-free condition. The fix involves dropping the reference on errors and reordering error-handling zones to prevent double-free and ensure proper cleanup (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation allows a local, low-privileged user to repeatedly trigger GPIO chip initialization failures, causing kernel memory and device references to leak without being reclaimed. Over time, this can exhaust kernel resources and crash the system, resulting in a denial of service. There is no impact on confidentiality or integrity; the vulnerability is limited to availability (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges, limiting its attack surface. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory).

Patches are available in Linux kernel stable branches. Users should update to kernel version 6.18.22, 6.19.12, or 7.0 (or later). The fixes are available in the upstream stable tree commits 16fdabe143fc, f0cf9c7b7c28, and fb4584d2b324. No configuration-based workaround is known; upgrading to a patched kernel version is the recommended remediation (Red Hat Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability as low severity/priority in their Bugzilla system, and it has been referenced in the Yocto Project security mailing list. No significant public researcher commentary or media coverage has been identified beyond standard kernel security tracking (Red Hat Bugzilla).