CVE-2026-90340: pinctrl: generic: free maps on pinctrl_generic_to_map() failure
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: generic: free maps on pinctrlgenerictomap() failure
pinctrlgenerictomap() parses DT configuration and allocates pinctrl maps via pinctrlutilsreservemap().
If subsequent steps (such as pinctrlutilsaddmapmux(), pinctrlgenericaddgroup(), pinconfgenericparsedtconfig(), or pinctrlutilsaddmapconfigs()) return an error, maps may contain partially allocated map entries. Returning the error directly without freeing maps leaks the allocated mapping memory across all drivers that rely on pinctrlgenerictomap().
Fix this by calling pinctrlutilsfreemap() and resetting maps, nummaps, and numreservedmaps in the error path of pinctrlgenerictomap().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the vulnerability by ensuring that when pinctrl_generic_to_map() returns an error in its error path, it calls pinctrl_utils_free_map() and resets *maps so allocated mapping memory (from pinctrl_utils_reserve_map()) is freed and not leaked across drivers.
Linux kernel pinctrl (pinctrl_utils_reserve_map / pinctrl_generic_to_map) Error handling in pinctrl_generic_to_map() = Call pinctrl_utils_free_map() and reset *maps on failure before returning the error
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running Linux kernel code in which drivers rely on pinctrl_generic_to_map() to parse device-tree pin configuration are exposed when that parsing encounters an error after map allocation has begun.
What must occur for the leak to be triggered?
Device-tree pinctrl configuration processing must fail after pinctrl_utils_reserve_map() has allocated map entries. The failure can occur in later mux-map, group, pin-configuration parsing, or configuration-map steps.
What is the impact if the error path is reached?
Partially allocated pinctrl mapping entries are leaked. The issue affects memory allocated during failed device-tree pinctrl map construction.
How can I determine whether a system is affected?
Review the kernel source for pinctrl_generic_to_map() and check whether its error path calls pinctrl_utils_free_map() and resets maps, num_maps, and num_reserved_maps. The provided fixes are available in the referenced stable kernel commits.