{"id":"AZL-110441","summary":"CVE-2026-92482 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip\n\nThe gpio_chip is allocated with device-managed memory but registered with\nthe non-managed gpiochip_add_data(). This was harmless while the drivers\nwere built-in, but once they can be built as modules and unbound/rmmod'd,\ndevm frees the gpio_chip's memory while it is still registered, causing a\nuse-after-free.\n\nRegister it with devm_gpiochip_add_data() so it shares the same\ndevice-managed lifecycle, which also lets the manual gpiochip_remove()\nerror paths go away.","modified":"2026-10-23T14:17:14.805565221Z","published":"2026-09-17T17:17:50Z","upstream":["CVE-2026-92482"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92482"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-110441.json"}}],"schema_version":"1.9.0"}