{"id":"CVE-2026-74519","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-74519","summary":"pinctrl: devicetree: don't free uninitialized dev_name on error path","details":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: devicetree: don't free uninitialized dev_name on error path\n\ndt_remember_or_free_map() duplicates dev_name for each map entry. If\nkstrdup_const() fails, dt_free_map() frees dev_name in all num_maps\nentries, including entries that have not been initialized.\n\nSome pinctrl drivers, including pinctrl-imx, allocate the map with\nkmalloc() and leave dev_name for the core to initialize. The untouched\nentries therefore contain uninitialized data which is passed to\nkfree_const().\n\nReproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection\nwhile binding the pinctrl-consuming device, under KASAN:\n\n  BUG: KASAN: double-free in dt_free_map+0x34/0xa4\n  Free of addr c425a900 by task init/1\n   kfree from dt_free_map+0x34/0xa4\n   dt_free_map from dt_remember_or_free_map+0x184/0x198\n   dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8\n   pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0\n\nInitialize all dev_name fields to NULL before duplicating the device\nname, making the full-map cleanup safe after a partial failure.","published":"2026-08-15T12:27:38.101Z","modified":"2026-08-18T03:56:50.353600147Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.6.151"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/015b5bcbcb622b32317642be91a7f79aa5413649"},{"type":"WEB","url":"https://git.kernel.org/stable/c/321fe3584a8298386938130d138191aa35040b75"},{"type":"WEB","url":"https://git.kernel.org/stable/c/929f6396baade89999ec8a1281232c101cbc727d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74519.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74519"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T03:56:50.353600147Z"}}