CVE-2026-74519

A flaw was found in the Linux kernel. An issue within the pinctrl subsystem's device tree handling could lead to a double-free vulnerability. This occurs when an error path during device binding attempts to free uninitialized memory, potentially allowing a local attacker to trigger a system crash and cause a denial of service.

A memory corruption bug in the pinctrl DeviceTree mapping path can occur when dt_remember_or_free_map() handles a partial allocation failure. If kstrdup_const() fails after only some map entries were initialized, dt_free_map() may pass uninitialized dev_name values from untouched kmalloc backed entries to kfree_const(), resulting in an invalid free or double-free. The observed failure was reproduced with failslab injection during binding of a pinctrl consuming device and was reported by KASAN as a double-free. For the CVSS the PR:L is used in the paranoid score because a local user may be able to influence memory pressure or device binding in some delegated environments, although typical direct control over pinctrl binding is administrative. The issue is not network reachable. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel heap memory corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.