Not yet scoredPublished Sep 24, 2026

CVE-2026-93274pinctrl: bcm2835: Don't remove an unregistered GPIO chip

Updated under an hour ago (Oct 26, 2026, 9:00 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devm_pinctrl_register() function fails, bcm2835_pinctrl_probe() calls gpiochip_remove() before gpiochip_add_data() has registered the GPIO chip. This means that upon failure the gpio_chip.gpiodev is NULL resulting in a null pointer dereference inside the gpiochip_remove() function. Remove the unnecessary function call to gpiochip_remove(). No GPIO cleanup is required because the GPIO chip has not yet been registered. Without this change there is potential for a kernel panic upon registration failure

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ba696b470839d70c6b8290c1f798bac7fb2a584c before d428863ca8baa4e9eaf781266ac219b017dcf277; from 79c6d4fa1be1fd0819c50ebb4dee101bbbc4d20e before f494cfc254cd509d7cbc44b843e0a6602a520a33; from 266423e60ea1b953fcc0cd97f3dad85857e434d1 before dd6b1919e41d1260259c4505777be565fb3a7efd; 266423e60ea1b953fcc0cd97f3dad85857e434d1 builds before 3b978fd0a3092b25561ac26bc1a87149fa981ddc; from 266423e60ea1b953fcc0cd97f3dad85857e434d1 before b8535f5c77cc61352d02a0c038a280127a8b8208; 266423e60ea1b953fcc0cd97f3dad85857e434d1 builds before 68ea6dd23b732081826c36033835468383487864; 266423e60ea1b953fcc0cd97f3dad85857e434d1 builds before 727f043d699ab0d5d87122c2177f2b45fbe58d35; 266423e60ea1b953fcc0cd97f3dad85857e434d1 builds before 32711f77db0641e57fd96fdc013bf1286b9f2514; and 4 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/d428863ca8baa4e9eaf781266ac219b017dcf277
https://git.kernel.org/stable/c/f494cfc254cd509d7cbc44b843e0a6602a520a33
https://git.kernel.org/stable/c/dd6b1919e41d1260259c4505777be565fb3a7efd
https://git.kernel.org/stable/c/3b978fd0a3092b25561ac26bc1a87149fa981ddc
https://git.kernel.org/stable/c/b8535f5c77cc61352d02a0c038a280127a8b8208
https://git.kernel.org/stable/c/68ea6dd23b732081826c36033835468383487864
https://git.kernel.org/stable/c/727f043d699ab0d5d87122c2177f2b45fbe58d35
https://git.kernel.org/stable/c/32711f77db0641e57fd96fdc013bf1286b9f2514

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.