In the Linux kernel’s pinctrl subsystem, device name strings for pin control map entries are duplicated without first being initialized. When a duplication fails, the code later frees every map entry’s name pointer, including those that were never set. This double‑free triggers a kernel crash and can potentially enable arbitrary code execution if an attacker supplies a crafted device tree or gains local kernel access.

All Linux kernels running a pre‑patched pinctrl driver, particularly those that include the pinctrl‑imx module. The flaw affects any distribution that ships a kernel before the change that initializes dev_name to NULL. Devices that use the mcimx6ul‑evk platform or similar hardware are known to reproduce the issue.

The CVSS score of 7.8 classifies the bug as High severity, but the EPSS score of less than 1% and the absence from the KEV catalog suggest very limited public exploitation. An attacker must trigger a string duplication failure during pinctrl binding, which is a relatively uncommon condition. The risk remains significant because a double‑free can cause a kernel panic or, if exploited carefully, arbitrary code execution. Prompt patching is advised to mitigate this vulnerability.