Description

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized dev_name on error path dt_remember_or_free_map() duplicates dev_name for each map entry. If kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps entries, including entries that have not been initialized. Some pinctrl drivers, including pinctrl-imx, allocate the map with kmalloc() and leave dev_name for the core to initialize. The untouched entries therefore contain uninitialized data which is passed to kfree_const(). Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection while binding the pinctrl-consuming device, under KASAN: BUG: KASAN: double-free in dt_free_map+0x34/0xa4 Free of addr c425a900 by task init/1 kfree from dt_free_map+0x34/0xa4 dt_free_map from dt_remember_or_free_map+0x184/0x198 dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8 pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0 Initialize all dev_name fields to NULL before duplicating the device name, making the full-map cleanup safe after a partial failure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:17:57.083Z",
  "pubdate": "2026-08-15T13:17:57.083Z",
  "executiveSummary": "A memory corruption vulnerability exists in the Linux kernel pinctrl subsystem, specifically within device tree map parsing routines. The flaw is characterized by a double-free condition triggered during error handling paths when memory allocation fails.\nThe impact of this vulnerability includes kernel memory corruption, potential kernel crashes, and potential denial of service scenarios affecting local system stability. The vulnerability affects Linux kernel instances utilizing pinctrl drivers such as pinctrl-imx that allocate maps via kmalloc() and rely on core initialization.\nRisk implications center on system availability, as triggering the memory corruption leads directly to kernel BUG checks and system faults under fault-injection conditions or memory pressure. Attacker capabilities are limited to local disruption if memory allocation failures can be induced or leveraged.\nExploitation requirements include local execution context or driver binding events capable of triggering slab allocation failures during device tree map processing in the pinctrl subsystem.",
  "technicalDetails": "The vulnerability resides in the dt_remember_or_free_map() function within the pinctrl device tree parsing component of the Linux kernel. The root cause stems from improper error handling when kstrdup_const() fails while duplicating the dev_name string for map entries.\nWhen dt_remember_or_free_map() processes map entries, certain pinctrl drivers like pinctrl-imx allocate the map structures using kmalloc() while leaving the dev_name fields uninitialized for the core to populate. If a subsequent call to kstrdup_const() fails partway through processing the num_maps entries, the error cleanup handler dt_free_map() is invoked to release allocated resources.\nBecause the map entries were allocated via kmalloc() without prior initialization of every dev_name field, the untouched and uninitialized entries contain stale or random data. The dt_free_map() function blindly passes these uninitialized pointers to kfree_const(). Under Kernel Address Sanitizer (KASAN) or standard slab allocators, this behavior leads to double-free conditions or invalid pointer frees, triggering a kernel BUG.\nThe step-by-step attack flow involves: (1) initiating the binding process for a pinctrl-consuming device; (2) triggering the execution of pinctrl_dt_to_map() and subsequently dt_remember_or_free_map(); (3) inducing a memory allocation failure via mechanisms such as slab fault injection during kstrdup_const(); (4) causing the error handling path to invoke dt_free_map() on uninitialized map entries; and (5) executing an invalid kfree_const() call on uninitialized pointer data, resulting in a kernel crash and denial of service.\nVulnerable components include the dt_remember_or_free_map() and dt_free_map() functions in the pinctrl subsystem. Exploitation requires local access, and the vulnerability manifests under low-memory or fault-injection conditions during device driver initialization."
}