{"api_version":"1","generated_at":"2026-07-23T13:28:24+00:00","cve":"CVE-2026-64022","urls":{"html":"https://cve.report/CVE-2026-64022","api":"https://cve.report/api/cve/CVE-2026-64022.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-64022","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-64022"},"summary":{"title":"gpio: aggregator: remove the software node when deactivating the aggregator","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: aggregator: remove the software node when deactivating the aggregator\n\nThe dynamic software node we create for the aggregator platform device\nwhen using configfs is leaked when the device is deactivated. Destroy it\nas the last step in the tear-down path.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-07-19 16:17:42","updated_at":"2026-07-19 16:17:42"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/9870ea9a4a25abef3e7af3445bfce2472528a546","name":"https://git.kernel.org/stable/c/9870ea9a4a25abef3e7af3445bfce2472528a546","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/61fef83f239ecace1cce716135762a2d9b7b1fc6","name":"https://git.kernel.org/stable/c/61fef83f239ecace1cce716135762a2d9b7b1fc6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3e657619cf7258cb53b1beaf0d02998297695cde","name":"https://git.kernel.org/stable/c/3e657619cf7258cb53b1beaf0d02998297695cde","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64022","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64022","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8 3e657619cf7258cb53b1beaf0d02998297695cde git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8 9870ea9a4a25abef3e7af3445bfce2472528a546 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 86f162e73d2d81ef6d819c06a3b6c2fda77a79b8 61fef83f239ecace1cce716135762a2d9b7b1fc6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.16","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.16 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.34 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0.11 7.0.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"64022","cve":"CVE-2026-64022","epss":"0.001660000","percentile":"0.061680000","score_date":"2026-07-20","updated_at":"2026-07-21 00:13:14"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpio/gpio-aggregator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3e657619cf7258cb53b1beaf0d02998297695cde","status":"affected","version":"86f162e73d2d81ef6d819c06a3b6c2fda77a79b8","versionType":"git"},{"lessThan":"9870ea9a4a25abef3e7af3445bfce2472528a546","status":"affected","version":"86f162e73d2d81ef6d819c06a3b6c2fda77a79b8","versionType":"git"},{"lessThan":"61fef83f239ecace1cce716135762a2d9b7b1fc6","status":"affected","version":"86f162e73d2d81ef6d819c06a3b6c2fda77a79b8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpio/gpio-aggregator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.16"},{"lessThan":"6.16","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.34","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.11","versionStartIncluding":"6.16","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1","versionStartIncluding":"6.16","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: aggregator: remove the software node when deactivating the aggregator\n\nThe dynamic software node we create for the aggregator platform device\nwhen using configfs is leaked when the device is deactivated. Destroy it\nas the last step in the tear-down path."}],"providerMetadata":{"dateUpdated":"2026-07-19T15:39:15.345Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/3e657619cf7258cb53b1beaf0d02998297695cde"},{"url":"https://git.kernel.org/stable/c/9870ea9a4a25abef3e7af3445bfce2472528a546"},{"url":"https://git.kernel.org/stable/c/61fef83f239ecace1cce716135762a2d9b7b1fc6"}],"title":"gpio: aggregator: remove the software node when deactivating the aggregator","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-64022","datePublished":"2026-07-19T15:39:15.345Z","dateReserved":"2026-07-19T07:54:57.027Z","dateUpdated":"2026-07-19T15:39:15.345Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-19 16:17:42","lastModifiedDate":"2026-07-19 16:17:42","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"64022","Ordinal":"1","Title":"gpio: aggregator: remove the software node when deactivating the","CVE":"CVE-2026-64022","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"64022","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: aggregator: remove the software node when deactivating the aggregator\n\nThe dynamic software node we create for the aggregator platform device\nwhen using configfs is leaked when the device is deactivated. Destroy it\nas the last step in the tear-down path.","Type":"Description","Title":"gpio: aggregator: remove the software node when deactivating the"}]}}}