CVE-2026-23158 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2026-23158?

CVE-2026-23158 has a CVSS score of N/A (Unknown). A use-after-free vulnerability in the Linux kernel's gpio-virtuser driver allows attackers to potentially crash the kernel or execute arbitrary code with kernel privileges. This affects Linux systems using the vulnerable gpio-virtuser driver, particularly those with configfs enabled. The vulnerability occurs during device cleanup when a mutex is accessed after the device memory has been freed.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's gpio-virtuser driver allows attackers to potentially crash the kernel or execute arbitrary code with kernel privileges. This affects Linux systems using the vulnerable gpio-virtuser driver, particularly those with configfs enabled. The vulnerability occurs during device cleanup when a mutex is accessed after the device memory has been freed.

💻 Affected Systems

Products:

Linux kernel with gpio-virtuser driver

Versions: Kernel versions containing the vulnerable code (specific version range not provided in CVE)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if gpio-virtuser driver is loaded and configfs is being used. Many systems may not have this driver loaded by default.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation to kernel mode allowing complete system compromise.

🟠

Likely Case

Kernel crash causing system instability or denial of service, requiring system reboot.

🟢

If Mitigated

Limited impact if the vulnerable driver is not loaded or configfs is not used.

🌐 Internet-Facing: LOW - Requires local access to the system and specific driver usage.

🏢 Internal Only: MEDIUM - Local attackers or malicious users could exploit this to crash systems or potentially escalate privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger configfs operations on the gpio-virtuser device. Exploitation requires precise timing to trigger the use-after-free condition.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patched in kernel commits: 53ad4a948a4586359b841d607c08fb16c5503230, 7bec90f605cfb138006f5ba575f2310593347110, 815a8e3bf72811d402b30bd4a53cde5e9df7a563

Vendor Advisory: https://git.kernel.org/stable/c/53ad4a948a4586359b841d607c08fb16c5503230

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commits. 2. Rebuild kernel if compiling from source. 3. Reboot system to load patched kernel.

🔧 Temporary Workarounds

Disable gpio-virtuser driver

all

Prevent loading of the vulnerable driver module

echo 'blacklist gpio_virtuser' >> /etc/modprobe.d/blacklist.conf
rmmod gpio_virtuser

Disable configfs for gpio-virtuser

all

Prevent access to the vulnerable configfs interface

echo 0 > /sys/kernel/config/gpio-virtuser/enable

🧯 If You Can't Patch

Restrict local user access to systems using the vulnerable driver
Implement strict access controls to prevent unauthorized users from accessing configfs interfaces

🔍 How to Verify

Check if Vulnerable:

Check if gpio_virtuser module is loaded: lsmod | grep gpio_virtuser

Check Version:

uname -r

Verify Fix Applied:

Check kernel version includes fix commits or verify gpio_virtuser module is not loaded

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
OOPs messages related to gpio_virtuser
Use-after-free detection in kernel logs

Network Indicators:

None - local vulnerability only

SIEM Query:

kernel: "gpio_virtuser" OR "use-after-free" OR "UAF"

📊 Metadata

CVE ID: CVE-2026-23158

CVSS v3 Score: N/A (Unknown)

Published: February 14, 2026

Last Updated: February 18, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON