CVE-2026-93274
Received Received - Intake

Null Pointer Dereference in Linux Kernel GPIO Chip

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devm_pinctrl_register() function fails, bcm2835_pinctrl_probe() calls gpiochip_remove() before gpiochip_add_data() has registered the GPIO chip. This means that upon failure the gpio_chip.gpiodev is NULL resulting in a null pointer dereference inside the gpiochip_remove() function. Remove the unnecessary function call to gpiochip_remove(). No GPIO cleanup is required because the GPIO chip has not yet been registered. Without this change there is potential for a kernel panic upon registration failure

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93274
EUVD
EUVD-2026-86146

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a GPIO chip is removed before it is registered if the pinctrl registration fails. This causes a null pointer dereference in gpiochip_remove(), potentially leading to a kernel panic.

Detection Guidance

This vulnerability is specific to the Linux kernel's BCM2835 pinctrl driver and may cause a kernel panic during GPIO chip registration failure. Detection requires checking kernel logs for null pointer dereference errors in the pinctrl subsystem or examining kernel source code for the affected driver.

Impact Analysis

If exploited, this could crash the system by causing a kernel panic during GPIO chip registration failure. It primarily affects systems using the BCM2835 pinctrl driver, potentially leading to denial of service.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a kernel-level issue causing potential kernel panics due to improper GPIO chip handling, which could lead to system instability but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the kernel patch that removes the unnecessary gpiochip_remove() call in the BCM2835 pinctrl driver. Update to a kernel version containing this fix. No immediate system-level mitigation is needed beyond patching as the issue only occurs during driver probe failure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93274. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart