CVE-2026-99050

In the Linux kernel, the following vulnerability has been resolved:

gpio: mpsse: fix race when arming the IRQ poll worker

gpio mpsse irq enable() arms the poll worker before publishing it: schedule work() runs before the worker is added to priv->workers. If gpio mpsse disconnect() walks the list in that window it misses the worker, and once disconnect returns, the USB core frees mpsse priv while the orphaned gpio mpsse poll() work keeps accessing it, causing a use-after-free.

Fix this by publishing and arming the worker in one irq spin critical section. Teardown walks the same list under irq spin, so a worker found on the list is guaranteed to be armed, and cancel work sync() handles it whether it is queued or running.

A worker armed after the disconnect walk would still be missed, so also set a new priv->dying flag under irq spin before the teardown walk, and check it in the same critical section, freeing it via kfree rcu() instead when the device is going away, since kfree() would be called with the IRQ core's raw spinlock held and may sleep on PREEMPT RT. schedule work() is safe to call with irq spin held, and the next probe gets a fresh mpsse priv, so the flag never needs to be cleared.

This issue was found by an in-house static analysis tool.