In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_ir…
CVE-2026-99050 · GHSA-77g9-3gmv-7p3q · EUVD-2026-108845 · published 23 Oct 2026
How serious is it
- Severity: high, CVSS score 7.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-99050?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 179ef1127d7a4f09f0e741fa9f30b8a8e7886271 <c0071ee496e1228976c72b096f529503222708a0
- Linux Linux: patch: 7.3
- Linux Linux: 179ef1127d7a4f09f0e741fa9f30b8a8e7886271 <7efa1a1953cd6b20b23a3524d5b4b81789c6ef25
- Linux Linux: patch: 0
- Linux Linux: patch: 7.2.11
- Linux Linux: 6.19
- Linux Linux: patch: 6.18.57
- Linux Linux: 6.18.6 <6.18.57
- Linux Linux: 472d900c8bcac301ae0e40fdca7db799bd989ff5 <76390ac0bca7e5058b7482eb4d951c3bda5df812
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
gpio: mpsse: fix race when arming the IRQ poll worker
gpio_mpsse_irq_enable() arms the poll worker before publishing it:
schedule_work() runs before the worker is added to priv->workers. If
gpio_mpsse_disconnect() walks the list in that window it misses the
worker, and once disconnect returns, the USB core frees mpsse_priv
while the orphaned gpio_mpsse_poll() work keeps accessing it, causing
a use-after-free.
Fix this by publishing and arming the worker in one irq_spin
critical section. Teardown walks the same list under irq_spin, so a
worker found on the list is guaranteed to be armed, and
cancel_work_sync() handles it whether it is queued or running.
A worker armed after the disconnect walk would still be missed, so
also set a new priv->dying flag under irq_spin before the teardown
walk, and check it in the same critical section, freeing it via
kfree_rcu() instead when the device is going away, since kfree()
would be called with the IRQ core's raw spinlock held and may sleep
on PREEMPT_RT. schedule_work() is safe to call with irq_spin held,
and the next probe gets a fresh mpsse_priv, so the flag never needs
to be cleared.
This issue was found by an in-house static analysis tool.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/76390ac0bca7e5058b7482eb4d951c3bda5df812
- git.kernel.org/stable/c/c0071ee496e1228976c72b096f529503222708a0
- git.kernel.org/stable/c/7efa1a1953cd6b20b23a3524d5b4b81789c6ef25
- nvd.nist.gov/vuln/detail/CVE-2026-99050
Merged from ENISA EUVD. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON