AZL-96555
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-96555.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-96555
- Upstream
- Published
- 2026-08-15T13:17:57Z
- Modified
- 2026-08-30T05:26:50Z
- Summary
- CVE-2026-74519 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: devicetree: don't free uninitialized dev_name on error path
dtrememberorfreemap() duplicates devname for each map entry. If kstrdupconst() fails, dtfreemap() frees devname in all nummaps entries, including entries that have not been initialized.
Some pinctrl drivers, including pinctrl-imx, allocate the map with kmalloc() and leave devname for the core to initialize. The untouched entries therefore contain uninitialized data which is passed to kfreeconst().
Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection while binding the pinctrl-consuming device, under KASAN:
BUG: KASAN: double-free in dtfreemap+0x34/0xa4 Free of addr c425a900 by task init/1 kfree from dtfreemap+0x34/0xa4 dtfreemap from dtrememberorfreemap+0x184/0x198 dtrememberorfreemap from pinctrldttomap+0x33c/0x4c8 pinctrldttomap from create_pinctrl+0x9c/0x5c0
Initialize all dev_name fields to NULL before duplicating the device name, making the full-map cleanup safe after a partial failure.
- References