Linux Kernel CVE-2026-46269

The vulnerability resides in drivers/pinctrl/canaan/pinctrl-k230.c within the Linux kernel, affecting the pinctrl subsystem for the Canaan Kendryte K230 SoC - an RISC-V based edge AI processor. CWE-476 (NULL Pointer Dereference) is the root cause: during driver probe via k230_pinctrl_probe(), the function k230_pinctrl_parse_dt() is called to parse devicetree nodes, which internally calls k230_pinctrl_parse_functions(). That function attempts to retrieve the device pointer via info->pctl_dev->dev, but info->pctl_dev is only assigned after k230_pinctrl_parse_dt() returns - creating a temporal ordering violation where the field is still NULL at dereference time. The kernel crash address (virtual address 0x68, offset into the pctl_dev struct) confirms this is a direct dereference of a NULL-based struct pointer. CPE data identifies the affected product as cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, covering a range of stable kernel branches. The fix replaces the NULL path with the already-available platform_device pointer passed to the probe function.