Linux Kernel EUVD-2026-32392

The vulnerability resides in the Rust-language implementation of the Linux kernel PWM (Pulse Width Modulation) subsystem, introduced as part of ongoing Rust-for-Linux efforts to rewrite driver infrastructure. PWM chips are kernel-managed hardware abstractions used for motor control, LED dimming, and clock generation; pwmchip_alloc() allocates the containing device structure and increments an initial reference count. Correct lifecycle management under the kernel's reference-counting model mandates that every error path calls pwmchip_put() to decrement this reference before returning, triggering the allocator's release callback when the count hits zero. CWE-401 (Missing Release of Memory after Effective Lifetime) precisely describes the root cause: the __pinned_init() Rust macro initialization function can return an error without the caller invoking pwmchip_put(), permanently orphaning the allocation. CPE data (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*) covers all Linux kernel versions within the commit range 7b3dce814a15bc5d9fb6124cd945291012c4ebb9 through the fix commits. Note that the input tag 'Information Disclosure' conflicts with the actual CWE-401 classification and CVSS impact metrics (C:N, I:N, A:H); this tag appears to be an erroneous classification artifact and should not inform risk decisions.