Linux CVE-2026-23337

The vulnerability is located in the pinctrl (pin controller) subsystem's generic configuration parser, specifically in the pinconf_generic_parse_dt_config() function. The Linux kernel's pinctrl framework manages hardware pin configuration for various SoCs and devices. The root cause is a CWE-401 Missing Release of Memory after Effective Lifetime issue, where allocated memory (the cfg buffer) is not properly freed when an error condition occurs during device tree configuration parsing. The affected code path handles dynamic device tree configuration parsing for pin control hardware, and when parse_dt_cfg() encounters an error, it returns immediately without jumping to the cleanup label that would invoke kfree(cfg). This is a resource management flaw rather than an exploitable memory corruption issue.