{"api_version":"1","generated_at":"2026-08-16T16:33:43+00:00","cve":"CVE-2026-74519","urls":{"html":"https://cve.report/CVE-2026-74519","api":"https://cve.report/api/cve/CVE-2026-74519.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-74519","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-74519"},"summary":{"title":"pinctrl: devicetree: don't free uninitialized dev_name on error path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: devicetree: don't free uninitialized dev_name on error path\n\ndt_remember_or_free_map() duplicates dev_name for each map entry. If\nkstrdup_const() fails, dt_free_map() frees dev_name in all num_maps\nentries, including entries that have not been initialized.\n\nSome pinctrl drivers, including pinctrl-imx, allocate the map with\nkmalloc() and leave dev_name for the core to initialize. The untouched\nentries therefore contain uninitialized data which is passed to\nkfree_const().\n\nReproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection\nwhile binding the pinctrl-consuming device, under KASAN:\n\n  BUG: KASAN: double-free in dt_free_map+0x34/0xa4\n  Free of addr c425a900 by task init/1\n   kfree from dt_free_map+0x34/0xa4\n   dt_free_map from dt_remember_or_free_map+0x184/0x198\n   dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8\n   pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0\n\nInitialize all dev_name fields to NULL before duplicating the device\nname, making the full-map cleanup safe after a partial failure.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 13:17:57","updated_at":"2026-08-15 13:17:57"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d","name":"https://git.kernel.org/stable/c/9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/015b5bcbcb622b32317642be91a7f79aa5413649","name":"https://git.kernel.org/stable/c/015b5bcbcb622b32317642be91a7f79aa5413649","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/321fe3584a8298386938130d138191aa35040b75","name":"https://git.kernel.org/stable/c/321fe3584a8298386938130d138191aa35040b75","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/929f6396baade89999ec8a1281232c101cbc727d","name":"https://git.kernel.org/stable/c/929f6396baade89999ec8a1281232c101cbc727d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8","name":"https://git.kernel.org/stable/c/ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-74519","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74519","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected be4c60b563edee3712d392aaeb0943a768df7023 929f6396baade89999ec8a1281232c101cbc727d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected be4c60b563edee3712d392aaeb0943a768df7023 321fe3584a8298386938130d138191aa35040b75 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected be4c60b563edee3712d392aaeb0943a768df7023 ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected be4c60b563edee3712d392aaeb0943a768df7023 9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected be4c60b563edee3712d392aaeb0943a768df7023 015b5bcbcb622b32317642be91a7f79aa5413649 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 03f69244302d7954f42f528ea2d45903ebbf59f3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 77440c3a37203e3f4667d06e37f76ef3968d2d8c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 679c4f27b8958b65bb51d1c3dfdbf3befe4a33a3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f88ac1330779c5bfdd79f7d7f7d4d3343c782f92 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f739a699db7d5a5cf39ca3ce2c84e4fe4a8f4c5d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.4.244 4.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.9.244 4.10 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.14.161 4.15 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.19.92 4.20 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.4.7 5.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.5","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.151 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.103 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.44 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.8 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc6 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/pinctrl/devicetree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"929f6396baade89999ec8a1281232c101cbc727d","status":"affected","version":"be4c60b563edee3712d392aaeb0943a768df7023","versionType":"git"},{"lessThan":"321fe3584a8298386938130d138191aa35040b75","status":"affected","version":"be4c60b563edee3712d392aaeb0943a768df7023","versionType":"git"},{"lessThan":"ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8","status":"affected","version":"be4c60b563edee3712d392aaeb0943a768df7023","versionType":"git"},{"lessThan":"9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d","status":"affected","version":"be4c60b563edee3712d392aaeb0943a768df7023","versionType":"git"},{"lessThan":"015b5bcbcb622b32317642be91a7f79aa5413649","status":"affected","version":"be4c60b563edee3712d392aaeb0943a768df7023","versionType":"git"},{"status":"affected","version":"03f69244302d7954f42f528ea2d45903ebbf59f3","versionType":"git"},{"status":"affected","version":"77440c3a37203e3f4667d06e37f76ef3968d2d8c","versionType":"git"},{"status":"affected","version":"679c4f27b8958b65bb51d1c3dfdbf3befe4a33a3","versionType":"git"},{"status":"affected","version":"f88ac1330779c5bfdd79f7d7f7d4d3343c782f92","versionType":"git"},{"status":"affected","version":"f739a699db7d5a5cf39ca3ce2c84e4fe4a8f4c5d","versionType":"git"},{"lessThan":"4.5","status":"affected","version":"4.4.244","versionType":"semver"},{"lessThan":"4.10","status":"affected","version":"4.9.244","versionType":"semver"},{"lessThan":"4.15","status":"affected","version":"4.14.161","versionType":"semver"},{"lessThan":"4.20","status":"affected","version":"4.19.92","versionType":"semver"},{"lessThan":"5.5","status":"affected","version":"5.4.7","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/pinctrl/devicetree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.5"},{"lessThan":"5.5","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.151","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.103","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.44","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.8","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc6","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.151","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.103","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.44","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.8","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc6","versionStartIncluding":"5.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.244","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.244","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.161","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.92","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: devicetree: don't free uninitialized dev_name on error path\n\ndt_remember_or_free_map() duplicates dev_name for each map entry. If\nkstrdup_const() fails, dt_free_map() frees dev_name in all num_maps\nentries, including entries that have not been initialized.\n\nSome pinctrl drivers, including pinctrl-imx, allocate the map with\nkmalloc() and leave dev_name for the core to initialize. The untouched\nentries therefore contain uninitialized data which is passed to\nkfree_const().\n\nReproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection\nwhile binding the pinctrl-consuming device, under KASAN:\n\n  BUG: KASAN: double-free in dt_free_map+0x34/0xa4\n  Free of addr c425a900 by task init/1\n   kfree from dt_free_map+0x34/0xa4\n   dt_free_map from dt_remember_or_free_map+0x184/0x198\n   dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8\n   pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0\n\nInitialize all dev_name fields to NULL before duplicating the device\nname, making the full-map cleanup safe after a partial failure."}],"providerMetadata":{"dateUpdated":"2026-08-15T12:27:38.101Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/929f6396baade89999ec8a1281232c101cbc727d"},{"url":"https://git.kernel.org/stable/c/321fe3584a8298386938130d138191aa35040b75"},{"url":"https://git.kernel.org/stable/c/ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8"},{"url":"https://git.kernel.org/stable/c/9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d"},{"url":"https://git.kernel.org/stable/c/015b5bcbcb622b32317642be91a7f79aa5413649"}],"title":"pinctrl: devicetree: don't free uninitialized dev_name on error path","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-74519","datePublished":"2026-08-15T12:27:38.101Z","dateReserved":"2026-08-15T05:44:03.910Z","dateUpdated":"2026-08-15T12:27:38.101Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 13:17:57","lastModifiedDate":"2026-08-15 13:17:57","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"74519","Ordinal":"1","Title":"pinctrl: devicetree: don't free uninitialized dev_name on error ","CVE":"CVE-2026-74519","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"74519","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: devicetree: don't free uninitialized dev_name on error path\n\ndt_remember_or_free_map() duplicates dev_name for each map entry. If\nkstrdup_const() fails, dt_free_map() frees dev_name in all num_maps\nentries, including entries that have not been initialized.\n\nSome pinctrl drivers, including pinctrl-imx, allocate the map with\nkmalloc() and leave dev_name for the core to initialize. The untouched\nentries therefore contain uninitialized data which is passed to\nkfree_const().\n\nReproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection\nwhile binding the pinctrl-consuming device, under KASAN:\n\n  BUG: KASAN: double-free in dt_free_map+0x34/0xa4\n  Free of addr c425a900 by task init/1\n   kfree from dt_free_map+0x34/0xa4\n   dt_free_map from dt_remember_or_free_map+0x184/0x198\n   dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8\n   pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0\n\nInitialize all dev_name fields to NULL before duplicating the device\nname, making the full-map cleanup safe after a partial failure.","Type":"Description","Title":"pinctrl: devicetree: don't free uninitialized dev_name on error "}]}}}