Linux Kernel CVE-2026-74519

Exploitation requires all of the following: (1) Local access with low-privilege credentials (mapped from CVSS PR:L) - remote unauthenticated exploitation is not possible. (2) The target system must run a pinctrl driver that allocates pin configuration map entries via kmalloc() and leaves dev_name fields uninitialized for the core to populate - specifically drivers such as pinctrl-imx targeting NXP iMX6/iMX6UL SoCs; systems using pinctrl drivers that pre-initialize dev_name are not affected. (3) A memory allocation failure must occur during kstrdup_const() within dt_remember_or_free_map() - this requires either significant memory pressure on the target system or a kernel-level fault injection mechanism (failslab), which is not available to unprivileged users in production kernels. (4) A pinctrl-consuming device binding event must be in progress simultaneously. Exploitation is NOT possible against default server or desktop Linux configurations; it is scoped to embedded/IoT deployments on specific ARM SoC platforms with constrained memory, and the allocation-failure trigger is a meaningful practical barrier.

The official CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a worst-case local privilege escalation scenario: low-privilege local access, no user interaction, and full kernel-level C/I/A impact. However, the AC:L rating appears optimistic given real-world conditions: triggering this path requires a memory allocation failure during pinctrl device tree map initialization, which in non-fault-injection environments demands significant memory pressure. Additionally, vulnerable exposure is hardware-specific - only platforms running pinctrl drivers that use kmalloc() without pre-initializing dev_name (e.g., pinctrl-imx on iMX6 boards) are directly affected. The EPSS score of 0.18% at the 8th percentile strongly reinforces low active exploitation probability. There is no CISA KEV listing, no known public exploit code, and no vendor security advisory beyond the upstream kernel commits. SSVC signals align: exploitation is unlikely to be automated, technical impact is high only if a full heap exploitation primitive can be constructed from the double-free primitive, which adds practical complexity. The realistic near-term risk is kernel panic (DoS) rather than privilege escalation, though the kernel heap corruption potential is genuine.

A local user with shell access on an embedded Linux system (e.g., an iMX6-based IoT gateway running pinctrl-imx) causes sustained memory pressure - through memory-exhausting processes or repeated allocation stress - timed to coincide with a pinctrl-consuming device binding event (e.g., a USB peripheral or kernel module load). When kstrdup_const() fails inside dt_remember_or_free_map(), the error-path cleanup frees uninitialized dev_name pointers from the partially constructed map, triggering a double-free in kernel heap memory. If the attacker can control heap layout (e.g., via heap spray through /dev interfaces), this primitive could be leveraged for kernel code execution and privilege escalation to root; absent such control, the immediate outcome is a kernel panic.