{"apiVersion":"1.0","identifier":"CVE-2026-74519","description":"In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don-t free uninitialized dev_name on error path dt_remember_or_free_map() duplicates dev_name for each map entry. If kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps entries, including entries that have not been initialized. Some pinctrl drivers, including pinctrl-imx, allocate the map with kmalloc() and leave dev_name for the core to initialize. The untouched entries therefore contain uninitialized data which is passed to kfree_const(). Reproduced on qemu-s mcimx6ul-evk (pinctrl-imx) with failslab injection while binding the pinctrl-consuming device, under KASAN: BUG: KASAN: double-free in dt_free_map+0x34/0xa4 Free of addr c425a900 by task init/1 kfree from dt_free_map+0x34/0xa4 dt_free_map from dt_remember_or_free_map+0x184/0x198 dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8 pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0 Initialize all dev_name fields to NULL before duplicating the device name, making the full-map cleanup safe after a partial failure.","publishedAt":"2026-08-15T13:17:57","lastModifiedAt":"2026-08-19T17:21:08","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74519","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00146,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74519","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74519","en":"https://www.redsauce.net/en/cves/CVE-2026-74519","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74519","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74519","de":"https://www.redsauce.net/de/cves/CVE-2026-74519","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74519","el":"https://www.redsauce.net/el/cves/CVE-2026-74519"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74519"}}