CVE-2026-74519: pinctrl: devicetree: don't free uninitialized dev_name on error path

CVE-2026-74519: pinctrl: devicetree: don't free uninitialized dev_name on error path

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: devicetree: don't free uninitialized dev_name on error path

dt_remember_or_free_map() duplicates dev_name for each map entry. If
kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps
entries, including entries that have not been initialized.

Some pinctrl drivers, including pinctrl-imx, allocate the map with
kmalloc() and leave dev_name for the core to initialize. The untouched
entries therefore contain uninitialized data which is passed to
kfree_const().

Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection
while binding the pinctrl-consuming device, under KASAN:

  BUG: KASAN: double-free in dt_free_map+0x34/0xa4
  Free of addr c425a900 by task init/1
   kfree from dt_free_map+0x34/0xa4
   dt_free_map from dt_remember_or_free_map+0x184/0x198
   dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8
   pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0

Initialize all dev_name fields to NULL before duplicating the device
name, making the full-map cleanup safe after a partial failure.

The Linux kernel CVE team has assigned CVE-2026-74519 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.5 with commit be4c60b563edee3712d392aaeb0943a768df7023 and fixed in 6.6.151 with commit 929f6396baade89999ec8a1281232c101cbc727d
	Issue introduced in 5.5 with commit be4c60b563edee3712d392aaeb0943a768df7023 and fixed in 6.12.103 with commit 321fe3584a8298386938130d138191aa35040b75
	Issue introduced in 5.5 with commit be4c60b563edee3712d392aaeb0943a768df7023 and fixed in 6.18.44 with commit ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8
	Issue introduced in 5.5 with commit be4c60b563edee3712d392aaeb0943a768df7023 and fixed in 7.1.8 with commit 9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d
	Issue introduced in 5.5 with commit be4c60b563edee3712d392aaeb0943a768df7023 and fixed in 7.2-rc6 with commit 015b5bcbcb622b32317642be91a7f79aa5413649
	Issue introduced in 4.4.244 with commit 03f69244302d7954f42f528ea2d45903ebbf59f3
	Issue introduced in 4.9.244 with commit 77440c3a37203e3f4667d06e37f76ef3968d2d8c
	Issue introduced in 4.14.161 with commit 679c4f27b8958b65bb51d1c3dfdbf3befe4a33a3
	Issue introduced in 4.19.92 with commit f88ac1330779c5bfdd79f7d7f7d4d3343c782f92
	Issue introduced in 5.4.7 with commit f739a699db7d5a5cf39ca3ce2c84e4fe4a8f4c5d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74519
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/pinctrl/devicetree.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/929f6396baade89999ec8a1281232c101cbc727d
	https://git.kernel.org/stable/c/321fe3584a8298386938130d138191aa35040b75
	https://git.kernel.org/stable/c/ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8
	https://git.kernel.org/stable/c/9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d
	https://git.kernel.org/stable/c/015b5bcbcb622b32317642be91a7f79aa5413649