CVE-2026-93274pinctrl: bcm2835: Don't remove an unregistered GPIO chip
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devm_pinctrl_register() function fails, bcm2835_pinctrl_probe() calls gpiochip_remove() before gpiochip_add_data() has registered the GPIO chip. This means that upon failure the gpio_chip.gpiodev is NULL resulting in a null pointer dereference inside the gpiochip_remove() function. Remove the unnecessary function call to gpiochip_remove(). No GPIO cleanup is required because the GPIO chip has not yet been registered. Without this change there is potential for a kernel panic upon registration failure
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ba696b470839d70c6b8290c1f798bac7fb2a584c before d428863ca8baa4e9eaf781266ac219b017dcf277; from 79c6d4fa1be1fd0819c50ebb4dee101bbbc4d20e before f494cfc254cd509d7cbc44b843e0a6602a520a33; from 266423e60ea1b953fcc0cd97f3dad85857e434d1 before dd6b1919e41d1260259c4505777be565fb3a7efd; 266423e60ea1b953fcc0cd97f3dad85857e434d1 builds before 3b978fd0a3092b25561ac26bc1a87149fa981ddc; from 266423e60ea1b953fcc0cd97f3dad85857e434d1 before b8535f5c77cc61352d02a0c038a280127a8b8208; 266423e60ea1b953fcc0cd97f3dad85857e434d1 builds before 68ea6dd23b732081826c36033835468383487864; 266423e60ea1b953fcc0cd97f3dad85857e434d1 builds before 727f043d699ab0d5d87122c2177f2b45fbe58d35; 266423e60ea1b953fcc0cd97f3dad85857e434d1 builds before 32711f77db0641e57fd96fdc013bf1286b9f2514; and 4 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/d428863ca8baa4e9eaf781266ac219b017dcf277
- https://git.kernel.org/stable/c/f494cfc254cd509d7cbc44b843e0a6602a520a33
- https://git.kernel.org/stable/c/dd6b1919e41d1260259c4505777be565fb3a7efd
- https://git.kernel.org/stable/c/3b978fd0a3092b25561ac26bc1a87149fa981ddc
- https://git.kernel.org/stable/c/b8535f5c77cc61352d02a0c038a280127a8b8208
- https://git.kernel.org/stable/c/68ea6dd23b732081826c36033835468383487864
- https://git.kernel.org/stable/c/727f043d699ab0d5d87122c2177f2b45fbe58d35
- https://git.kernel.org/stable/c/32711f77db0641e57fd96fdc013bf1286b9f2514
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.