VYPR
← All advisories
Medium severity5.5NVD Advisory· Published May 30, 2024· Updated May 12, 2026

CVE-2024-36959

CVE-2024-36959

Description

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()

If we fail to allocate propname buffer, we need to drop the reference count we just took. Because the pinctrl_dt_free_maps() includes the droping operation, here we call it directly.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, a refcount leak in pinctrl_dt_to_map() can lead to a memory leak if a buffer allocation fails; local low-privileged exploitation possible.

Overview

CVE-2024-36959 describes a refcount leak vulnerability in the Linux kernel's pin control device-tree mapping function, pinctrl_dt_to_map(). The flaw arises because when the function attempts to allocate a buffer for the propname string and that allocation fails, it returns without decrementing the reference count that was previously taken on a device node. This oversight causes a reference count imbalance, resulting in a memory leak as the device node cannot be properly freed.

Exploitation

The vulnerability is triggered by a local user or process that can cause the kernel to invoke pinctrl_dt_to_map() in a situation where a memory allocation for the propname buffer fails. No special privileges beyond normal user access are required, though the attacker must be able to interact with the pin control subsystem, typically through device tree probing or certain ioctl operations. The attack requires low complexity and user interaction is not required beyond triggering the failing allocation.

Impact

If successfully exploited, the attacker can cause a kernel memory leak by preventing the device node's reference counter from reaching zero, which prevents the kernel from freeing that memory. While this does not directly allow code execution or privilege escalation, it can lead to resource exhaustion and denial of service (system hang or crash) over time, as available kernel memory is depleted [1]. The CVSS v3.1 base score is 5.5 (Medium) with a vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, indicating a local attack with no privileges required, but requiring user interaction and resulting only in availability impact.

Mitigation

The fix, already committed to the Linux kernel source tree, directly calls pinctrl_dt_free_maps() in the error path to ensure the reference count is decremented when the buffer allocation fails. Users should update their kernel to a version that includes this patch. Siemens has confirmed that affected products (e.g., SIMATIC S7-1500 TM MFP - GNU/Linux subsystem) are impacted and recommends applying the security updates provided in their advisory SSA-265688 [2].

References
  1. SSA-613116
  2. SSA-265688

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

108

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.