CVE-2026-74519

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: devicetree: don't free uninitialized dev_name on error path

dt_remember_or_free_map() duplicates dev_name for each map entry. If

kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps

entries, including entries that have not been initialized.

Some pinctrl drivers, including pinctrl-imx, allocate the map with

kmalloc() and leave dev_name for the core to initialize. The untouched

entries therefore contain uninitialized data which is passed to

kfree_const().

Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection

while binding the pinctrl-consuming device, under KASAN:

BUG: KASAN: double-free in dt_free_map+0x34/0xa4

Free of addr c425a900 by task init/1

kfree from dt_free_map+0x34/0xa4

dt_free_map from dt_remember_or_free_map+0x184/0x198

dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8

pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0

Initialize all dev_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References