Double-Free Vulnerability in Linux Kernel cs42l43 Pin Control Module

Publication date: 2026-03-25

Last updated on: 2026-04-24

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() devm_add_action_or_reset() already invokes the action on failure, so the explicit put causes a double-put.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-25

Last Modified

2026-04-24

Generated

2026-07-06

AI Q&A

2026-03-25

EPSS Evaluated

2026-07-05

NVD

CVE-2026-23387

EUVD

EUVD-2026-15387

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.17.10 (inc) to 6.18 (exc)
linux	linux_kernel	6.18
linux	linux_kernel	From 6.18.1 (inc) to 6.18.17 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.7 (exc)
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 6.12.60 (inc) to 6.12.77 (exc)
linux	linux_kernel	From 6.6.118 (inc) to 6.6.130 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-415	The product calls free() twice on the same memory address.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel specifically in the pinctrl driver for the Cirrus Logic cs42l43 device. The issue is a double-put error in the function cs42l43_pin_probe(). The function devm_add_action_or_reset() already performs a cleanup action on failure, so an additional explicit put call causes the same resource to be released twice, which is a programming error.

Impact Analysis

A double-put error can lead to undefined behavior such as memory corruption or system instability. In the context of the Linux kernel, this could potentially cause crashes or other unpredictable behavior when the cs42l43 pinctrl driver is used.

Hi! I’m here to help you understand CVE-2026-23387. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70