CVE-2026-98397

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown

In gpio secondary fwnode init(), acpi bus find device by name() returns a device reference, but the local dev variable is declared with free(put device), dropping the reference at the end of each iteration. Meanwhile, devm add action or reset() saves the dev pointer for gpio secondary unset() without incrementing its reference count, which could lead to a use-after-free during driver teardown if the device is released in the interim.

Acquire an explicit device reference with get device() when registering the devres action, and drop it with put device() inside gpio secondary unset().