CVE-2026-74519
Received Received - Intake

Double-Free in Linux Kernel Pinctrl Subsystem

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized dev_name on error path dt_remember_or_free_map() duplicates dev_name for each map entry. If kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps entries, including entries that have not been initialized. Some pinctrl drivers, including pinctrl-imx, allocate the map with kmalloc() and leave dev_name for the core to initialize. The untouched entries therefore contain uninitialized data which is passed to kfree_const(). Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection while binding the pinctrl-consuming device, under KASAN: BUG: KASAN: double-free in dt_free_map+0x34/0xa4 Free of addr c425a900 by task init/1 kfree from dt_free_map+0x34/0xa4 dt_free_map from dt_remember_or_free_map+0x184/0x198 dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8 pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0 Initialize all dev_name fields to NULL before duplicating the device name, making the full-map cleanup safe after a partial failure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74519
EUVD
EUVD-2026-59712

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux_kernel pinctrl *
linux_kernel pinctrl-imx *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a double-free vulnerability in the Linux kernel's pinctrl subsystem. It occurs when the function dt_remember_or_free_map() fails to initialize all device name fields before duplicating them. If memory allocation fails during this process, the function attempts to free uninitialized memory, leading to a double-free error that can crash the system.

Detection Guidance

This vulnerability is specific to the Linux kernel's pinctrl subsystem and requires kernel-level detection. Check kernel logs for KASAN double-free errors during pinctrl device binding. Monitor for crashes when loading pinctrl-imx or similar drivers. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could cause kernel crashes or instability when binding pinctrl-consuming devices on affected systems. It may lead to denial-of-service conditions or require system reboot to recover. Systems using pinctrl-imx or similar drivers are particularly at risk.

Mitigation Strategies

Update to a patched Linux kernel version that includes the fix for this issue. If immediate patching is not possible, avoid using affected pinctrl drivers like pinctrl-imx until the update is applied. Monitor kernel logs for related errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74519. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart