CVE-2026-31745: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31745 is a double free vulnerability in the Linux kernel's reset GPIO auxiliary device error handling path, specifically within the reset_add_gpio_aux_device() function. When __auxiliary_device_add() fails, the function calls auxiliary_device_uninit(adev), which triggers the device release callback reset_gpio_aux_device_release() that frees the allocated memory — but the error path then calls kfree(adev) again, causing a double free condition. The vulnerability affects Linux kernel versions 6.19 through 6.19.11 and 7.0 release candidates (rc1–rc7). It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-415 (Double Free) and CWE-1341 (Multiple Releases of Same Resource or Handle). The flaw exists in the error handling logic of reset_add_gpio_aux_device() in the kernel's reset GPIO driver: when __auxiliary_device_add() fails, the code calls auxiliary_device_uninit(), which internally invokes the registered release callback reset_gpio_aux_device_release() to free the adev structure; the subsequent explicit kfree(adev) in the same error path then attempts to free already-released memory. The fix retains kfree(adev) only for the auxiliary_device_init() failure path (where the release callback has not yet been registered) and removes the redundant kfree() after auxiliary_device_uninit(). Upstream patches are available at commits 1de465753220deb41569cf2add87bbb0673731db and fbffb8c7c7bb4d38e9f65e0bee446685011de5d8 (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).

A local user with low privileges can trigger this vulnerability by inducing a reset GPIO device initialization failure scenario, potentially allowing them to execute arbitrary code with kernel privileges, read sensitive kernel memory, or crash the system. The double free condition can corrupt kernel heap memory, which may be leveraged for privilege escalation from a low-privileged local account to full kernel-level control. Confidentiality, integrity, and availability are all rated as High impact (Red Hat Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of this report. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to trigger a specific error condition in the reset GPIO subsystem (Red Hat Advisory).

Upgrade the Linux kernel to version 6.19.12 or later, which includes the fix for this double free vulnerability. For systems running 7.0 release candidates, update to the stable 7.0 release once available. Alternatively, apply the upstream patches directly to the kernel source: commits 1de465753220deb41569cf2add87bbb0673731db and fbffb8c7c7bb4d38e9f65e0bee446685011de5d8. Monitor systems for unexpected kernel crashes or memory corruption events related to reset GPIO operations as a precautionary measure (Red Hat Advisory, Kernel Patch 1, Kernel Patch 2).