CVE-2026-46269
NULL Pointer Dereference in Linux Kernel K230 Pinctrl Driver
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| canaan | k230 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's k230 pinctrl driver when it tries to parse the device tree. During this process, the driver attempts to access a device pointer through an uninitialized structure, specifically info->pctl_dev->dev, where info->pctl_dev is still NULL. This leads to a NULL pointer dereference, causing the kernel to crash.
The root cause is that the device pointer is accessed before it is properly initialized. The fix involves using the device pointer already available from the platform_device instead of the uninitialized pctl_dev pointer.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to a NULL pointer dereference when the k230 pinctrl driver is probed. Such a crash can lead to system instability, denial of service, or unexpected reboots, potentially disrupting normal operations on affected devices using this driver.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability causes a NULL pointer dereference in the Linux kernel when probing the k230 pinctrl driver, leading to a kernel crash.
Detection can be done by monitoring kernel logs for crash traces similar to the following message:
- [ 0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068
- [ 0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc
You can check the kernel logs using commands such as:
- dmesg | grep -i 'k230_pinctrl_probe'
- journalctl -k | grep -i 'NULL pointer dereference'
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the k230 pinctrl driver has been fixed.
The fix involves using the already available device pointer from platform_device instead of accessing through the uninitialized pctl_dev pointer.
Until the update is applied, avoid probing or using the k230 pinctrl driver to prevent kernel crashes.