What is the CVSS score of EUVD-2026-59712?

EUVD-2026-59712 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-59712?

CVE-2026-74519 is a double-free memory corruption vulnerability in the Linux kernel's pinctrl subsystem that affects systems running specific pinctrl drivers, particularly NXP iMX6 platforms.. A patch is available.

How to fix or mitigate EUVD-2026-59712?

Within 24 hours, inventory all systems running affected pinctrl drivers, particularly pinctrl-imx on iMX6 platforms, to establish remediation scope. Within 7 days, apply the vendor-released patch to identified systems in staged rollout, beginning with test and non-production environments to validate compatibility. Within 30 days, complete full production deployment and verification across all Linux infrastructure running pinctrl drivers to ensure comprehensive coverage.

Linux Kernel EUVD-2026-59712

| CVE-2026-74519 HIGH

2026-08-15 Linux

GHSA-63f7-w376-3432

Code Injection Linux Red Hat Suse

7.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

AC:H reflects that exploitation requires concurrent allocation failure and device binding on specific embedded hardware; other metrics match official assessment.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.4 MEDIUM

AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:04 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: devicetree: don't free uninitialized dev_name on error path

dt_remember_or_free_map() duplicates dev_name for each map entry. If kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps entries, including entries that have not been initialized.

Some pinctrl drivers, including pinctrl-imx, allocate the map with kmalloc() and leave dev_name for the core to initialize. The untouched entries therefore contain uninitialized data which is passed to kfree_const().

Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection while binding the pinctrl-consuming device, under KASAN:

BUG: KASAN: double-free in dt_free_map+0x34/0xa4 Free of addr c425a900 by task init/1 kfree from dt_free_map+0x34/0xa4 dt_free_map from dt_remember_or_free_map+0x184/0x198 dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8 pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0

Initialize all dev_name fields to NULL before duplicating the device name, making the full-map cleanup safe after a partial failure.

AnalysisAI

Double-free memory corruption in the Linux kernel's pinctrl/devicetree subsystem enables a local low-privileged attacker on systems running affected pinctrl drivers - such as pinctrl-imx on NXP iMX6 platforms - to corrupt kernel heap memory, with theoretical potential for local privilege escalation. The flaw resides in the error-cleanup path of dt_remember_or_free_map(): when kstrdup_const() fails mid-loop, dt_free_map() iterates over all map entries including those never initialized by the core, passing uninitialized kmalloc() data to kfree_const() - a KASAN-confirmed double-free. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Gain local unprivileged shell

Delivery

Stress system memory to induce allocation failure

Exploit

Trigger pinctrl device tree binding event

Install

kstrdup_const() fails mid-loop in dt_remember_or_free_map()

dt_free_map() calls kfree_const() on uninitialized dev_name pointers

Execute

Double-free corrupts kernel heap

Impact

Exploit heap primitive for privilege escalation

Recon

Gain local unprivileged shell

Delivery

Stress system memory to induce allocation failure

Exploit

Trigger pinctrl device tree binding event

Install

kstrdup_const() fails mid-loop in dt_remember_or_free_map()

dt_free_map() calls kfree_const() on uninitialized dev_name pointers

Execute

Double-free corrupts kernel heap

Impact

Exploit heap primitive for privilege escalation

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following: (1) Local access with low-privilege credentials (mapped from CVSS PR:L) - remote unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The official CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a worst-case local privilege escalation scenario: low-privilege local access, no user interaction, and full kernel-level C/I/A impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local user with shell access on an embedded Linux system (e.g., an iMX6-based IoT gateway running pinctrl-imx) causes sustained memory pressure - through memory-exhausting processes or repeated allocation stress - timed to coincide with a pinctrl-consuming device binding event (e.g., a USB peripheral or kernel module load). When `kstrdup_const()` fails inside `dt_remember_or_free_map()`, the error-path cleanup frees uninitialized `dev_name` pointers from the partially constructed map, triggering a double-free in kernel heap memory. …
Remediation	The authoritative fix is to upgrade to a patched Linux kernel stable release: 6.6.151 or later in the 6.6 stable series, 6.12.103 or later in the 6.12 series, 6.18.44 or later in the 6.18 series, 7.1.8 or later in the 7.1 series, or 7.2-rc6 or later for release candidates, per EUVD-2026-59712. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running affected pinctrl drivers, particularly pinctrl-imx on iMX6 platforms, to establish remediation scope. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2024-23692 CRITICAL POC

9.8

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-59712 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-59712

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Code Injection

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code