CVE-2026-23337

MEDIUM

pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()

Title source: cna
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config() In pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns directly. This bypasses the cleanup logic and results in a memory leak of the cfg buffer. Fix this by jumping to the out label on failure, ensuring kfree(cfg) is called before returning.

Scores

CVSS v3 5.5
EPSS 0.0002
EPSS Percentile 4.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-401
Status published
Products (11)
linux/Kernel 6.19.0 - 6.19.7linux
Linux/Linux < 6.19
Linux/Linux 6.19
Linux/Linux 6.19.7 - 6.19.*
Linux/Linux 7.0
Linux/Linux 7.0-rc3
Linux/Linux 90a18c512884adb49ddc2fb30e94594169aae808 - 63ee429780a5d43b5b4406c6128109b0f47cf2f1
Linux/Linux 90a18c512884adb49ddc2fb30e94594169aae808 - 7a648d598cb8e8c62af3f0e020a25820a3f3a9a7
linux/linux_kernel 6.19
linux/linux_kernel 7.0 rc1 (7 CPE variants)
... and 1 more
Published Mar 25, 2026
Tracked Since Mar 25, 2026