pinctrl: core: delete incorrect free in pinctrl_enable()

Summary

In the Linux kernel, the following vulnerability has been resolved: pinctrl: core: delete incorrect free in pinctrl_enable() The "pctldev" struct is allocated in devm_pinctrl_register_and_init(). It's a devm_ managed pointer that is freed by devm_pinctrl_dev_release(), so freeing it in pinctrl_enable() will lead to a double free. The devm_pinctrl_dev_release() function frees the pindescs and destroys the mutex as well.

Timeline

1. May 30, 2024, 3:29 PM UTCCVE published
2. Jun 5, 2024, 2:25 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Oct 15, 2026, 12:42 AM UTCRecord last updated

Affected versions

• Linux Linux

  From 6118714275f0a313ecc296a87ed1af32d9691bed · fixed in 735f4c6b6771eafe336404c157ca683ad72a040d; From 6118714275f0a313ecc296a87ed1af32d9691bed · fixed in cdaa171473d98962ae86f2a663d398fda2fbeefd; From 6118714275f0a313ecc296a87ed1af32d9691bed · fixed in 288bc4aa75f150d6f1ee82dd43c6da1b438b6068; From 6118714275f0a313ecc296a87ed1af32d9691bed · fixed in 41f88ef8ba387a12f4a2b8c400b6c9e8e54b2cca; From 6118714275f0a313ecc296a87ed1af32d9691bed · fixed in ac7d65795827dc0cf7662384ed27caf4066bd72e; From 6118714275f0a313ecc296a87ed1af32d9691bed · fixed in 558c8039fdf596a584a92c171cbf3298919c448c; From 6118714275f0a313ecc296a87ed1af32d9691bed · fixed in f9f1e321d53e4c5b666b66e5b43da29841fb55ba; From 6118714275f0a313ecc296a87ed1af32d9691bed · fixed in 5038a66dad0199de60e5671603ea6623eb9e5c79

• Linux Linux

  4.11

• KernelLinux

  From 4.11.0 · fixed in 4.19.314; From 4.20.0 · fixed in 5.4.276; From 5.5.0 · fixed in 5.10.217; From 5.11.0 · fixed in 5.15.159; From 5.16.0 · fixed in 6.1.91; From 6.2.0 · fixed in 6.6.31; From 6.7.0 · fixed in 6.8.10

References 8