Medium 5.5Published May 30, 2024

CVE-2024-36959pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()

Updated under an hour ago (Oct 27, 2026, 4:30 PM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a988dcd3dd9e691c5ccc3324b209688f3b5453e9 before 06780473cb8a858d1d6cab2673e021b072a852d1; from 040f726fecd88121f3b95e70369785ad452dddf9 before 47d253c485491caaf70d8cd8c0248ae26e42581f; 777430aa4ddccaa5accec6db90ffc1d47f00d471 builds before 35ab679e8bb5a81a4f922d3efbd43e32bce69274; 97e5b508e96176f1a73888ed89df396d7041bfcb builds before 76aa2440deb9a35507590f2c981a69a57ecd305d; from 91d5c5060ee24fe8da88cd585bb43b843d2f0dce before 518d5ddafeb084d6d9b1773ed85164300037d0e6; 91d5c5060ee24fe8da88cd585bb43b843d2f0dce builds before 026e24cf31733dbd97f41cc9bc5273ace428eeec; from 91d5c5060ee24fe8da88cd585bb43b843d2f0dce before c7e02ccc9fdc496fe51e440e3e66ac36509ca049; from 91d5c5060ee24fe8da88cd585bb43b843d2f0dce before a0cedbcc8852d6c77b00634b81e41f17f29d9404; and 10 more ranges	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V3.1	CISA ADP
Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family siemens:scalance_xc_300_xr_300_xc_400_xr_500wg_xr_500_family (from the name)	all versions not affected	CISA ADP
Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family siemens:scalance_xcm_xrm_xch_xrh_300_family (from the name)	before V3.1	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.9.334 before 4.10; from 4.14.300 before 4.15; from 4.19.267 before 4.19.314; from 5.4.225 before 5.4.276; from 5.10.156 before 5.10.217; from 5.15.80 before 5.15.159; from 6.0.10 before 6.1.91; from 6.2 before 6.6.31; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/06780473cb8a858d1d6cab2673e021b072a852d1	patch
https://git.kernel.org/stable/c/47d253c485491caaf70d8cd8c0248ae26e42581f	patch
https://git.kernel.org/stable/c/35ab679e8bb5a81a4f922d3efbd43e32bce69274	patch
https://git.kernel.org/stable/c/76aa2440deb9a35507590f2c981a69a57ecd305d	patch
https://git.kernel.org/stable/c/518d5ddafeb084d6d9b1773ed85164300037d0e6	patch
https://git.kernel.org/stable/c/026e24cf31733dbd97f41cc9bc5273ace428eeec	patch
https://git.kernel.org/stable/c/c7e02ccc9fdc496fe51e440e3e66ac36509ca049	patch
https://git.kernel.org/stable/c/a0cedbcc8852d6c77b00634b81e41f17f29d9404	patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html	mailing-list
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html	mailing-list
1–10 of 12

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.