Medium severity · published May 30, 2024
CVE-2024-36959
pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()
If we fail to allocate propname buffer, we need to drop the reference
count we just took. Because the pinctrl_dt_free_maps() includes the
droping operation, here we call it directly.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
4.9.334 before 4.10; 4.14.300 before 4.15; 4.19.267 before 4.19.314; 5.4.225 before 5.4.276; 5.10.156 before 5.10.217; 5.15.80 before 5.15.159; +9 more · source: NVD
LI
Linux · Linux
a988dcd3dd9e691c5ccc3324b209688f3b5453e9 before 06780473cb8a858d1d6cab2673e021b072a852d1; 040f726fecd88121f3b95e70369785ad452dddf9 before 47d253c485491caaf70d8cd8c0248ae26e42581f; 777430aa4ddccaa5accec6db90ffc1d47f00d471 before 35ab679e8bb5a81a4f922d3efbd43e32bce69274; 97e5b508e96176f1a73888ed89df396d7041bfcb before 76aa2440deb9a35507590f2c981a69a57ecd305d; 91d5c5060ee24fe8da88cd585bb43b843d2f0dce before 518d5ddafeb084d6d9b1773ed85164300037d0e6; 91d5c5060ee24fe8da88cd585bb43b843d2f0dce before 026e24cf31733dbd97f41cc9bc5273ace428eeec; +13 more · source: vendor
RR
RUGGEDCOM RST2428P · Siemens
before V3.1 · source: CISA
SX
SCALANCE XCM-/XRM-/XCH-/XRH-300 family · Siemens
before V3.1 · source: CISA
SS
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens
before V1.1.1 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-36959
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-36959
Patch
https://git.kernel.org/stable/c/026e24cf31733dbd97f41cc9bc5273ace428eeec
Patch
https://git.kernel.org/stable/c/06780473cb8a858d1d6cab2673e021b072a852d1
Patch
https://git.kernel.org/stable/c/35ab679e8bb5a81a4f922d3efbd43e32bce69274
Patch
https://git.kernel.org/stable/c/47d253c485491caaf70d8cd8c0248ae26e42581f
Patch
https://git.kernel.org/stable/c/518d5ddafeb084d6d9b1773ed85164300037d0e6
Patch
https://git.kernel.org/stable/c/76aa2440deb9a35507590f2c981a69a57ecd305d
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability