CVE-2026-74519: pinctrl: devicetree: don't free uninitialized dev_name on error path
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: devicetree: don't free uninitialized devname on error path
dtrememberorfreemap() duplicates devname for each map entry. If kstrdupconst() fails, dtfreemap() frees devname in all nummaps entries, including entries that have not been initialized.
Some pinctrl drivers, including pinctrl-imx, allocate the map with kmalloc() and leave devname for the core to initialize. The untouched entries therefore contain uninitialized data which is passed to kfreeconst().
Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection while binding the pinctrl-consuming device, under KASAN:
BUG: KASAN: double-free in dtfreemap+0x34/0xa4 Free of addr c425a900 by task init/1 kfree from dtfreemap+0x34/0xa4 dtfreemap from dtrememberorfreemap+0x184/0x198 dtrememberorfreemap from pinctrldttomap+0x33c/0x4c8 pinctrldttomap from createpinctrl+0x9c/0x5c0
Initialize all devname fields to NULL before duplicating the device name, making the full-map cleanup safe after a partial failure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74519?
CVE-2026-74519 has a risk rating of 19, indicating a critical severity level.
How do I fix CVE-2026-74519?
To fix CVE-2026-74519, update to the latest version of the Linux kernel where the vulnerability has been resolved.
What systems are affected by CVE-2026-74519?
CVE-2026-74519 affects the Linux kernel, specifically implementations that utilize the pinctrl subsystem.
What is the impact of CVE-2026-74519?
The vulnerability can lead to the freeing of uninitialized memory, potentially causing system instability or crashes.
Is CVE-2026-74519 being actively exploited?
As of now, there is no evidence indicating that CVE-2026-74519 is being actively exploited in the wild.