CVE-2026-93274 - Vulnerability Details

- pinctrl: bcm2835: Don't remove an unregistered GPIO chip

Description

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: bcm2835: Don't remove an unregistered GPIO chip

If the devm_pinctrl_register() function fails,
bcm2835_pinctrl_probe() calls gpiochip_remove()
before gpiochip_add_data() has registered the GPIO chip.

This means that upon failure the gpio_chip.gpiodev
is NULL resulting in a null pointer dereference
inside the gpiochip_remove() function.

Remove the unnecessary function call to gpiochip_remove().
No GPIO cleanup is required because the GPIO chip
has not yet been registered. Without this change there
is potential for a kernel panic upon registration failure

Published: 2026-09-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A failure to properly register the BCM2835 GPIO chip in the Linux kernel causes the BCM2835 pinctrl driver to invoke gpiochip_remove() on an uninitialized GPIO chip pointer. This leads to a null pointer dereference inside the kernel and an immediate kernel panic. The consequence is a loss of system availability, as the machine become unusable until a reboot.

Affected Systems

The vulnerability affects Linux kernel builds that include the BCM2835 pinctrl driver. This driver is used on Broadcom-based hardware such as the BCM2835 processors found in many single-board computers. The CNA vendor information lists only the Linux kernel, and no specific product names or version ranges are supplied; therefore any kernel version containing the unpatched driver may be impacted. Systems that disable or do not load this driver are not affected.

Risk and Exploitability

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. The likely attack vector is local, requiring the attacker to influence the driver initialization so that the GPIO chip fails to register—such as by tampering with firmware or loading a modified module. When triggered the kernel will panic, providing a denial‑of‑service outcome. The CVSS score is 5.5, indicating moderate severity. It is inferred that the risk of exploitation is low under normal operation but not zero if the driver path can be forced to fail.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ba696b470839d70c6b8290c1f798bac7fb2a584c`	affected	< d428863ca8baa4e9eaf781266ac219b017dcf277
`79c6d4fa1be1fd0819c50ebb4dee101bbbc4d20e`	affected	< f494cfc254cd509d7cbc44b843e0a6602a520a33
`266423e60ea1b953fcc0cd97f3dad85857e434d1`	affected	< dd6b1919e41d1260259c4505777be565fb3a7efd
`266423e60ea1b953fcc0cd97f3dad85857e434d1`	affected	< 3b978fd0a3092b25561ac26bc1a87149fa981ddc
`266423e60ea1b953fcc0cd97f3dad85857e434d1`	affected	< b8535f5c77cc61352d02a0c038a280127a8b8208
`266423e60ea1b953fcc0cd97f3dad85857e434d1`	affected	< 68ea6dd23b732081826c36033835468383487864
`266423e60ea1b953fcc0cd97f3dad85857e434d1`	affected	< 727f043d699ab0d5d87122c2177f2b45fbe58d35
`266423e60ea1b953fcc0cd97f3dad85857e434d1`	affected	< 32711f77db0641e57fd96fdc013bf1286b9f2514
`75278f1aff5e14c904d3503c6f836c42a7afb441`	affected	—
`5.10.89`	affected	< 5.10.270
`5.15.12`	affected	< 5.15.221
`5.4.175`	affected	< 5.5

Linux

affected

Version	Status	Constraints
`5.16`	affected	—
`0`	unaffected	< 5.16
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ba696b470839d70c6b8290c1f798bac7fb2a584c,d428863ca8baa4e9eaf781266ac219b017dcf277)`	affected	code_commit	—
`[79c6d4fa1be1fd0819c50ebb4dee101bbbc4d20e,f494cfc254cd509d7cbc44b843e0a6602a520a33)`	affected	code_commit	—
`[266423e60ea1b953fcc0cd97f3dad85857e434d1,dd6b1919e41d1260259c4505777be565fb3a7efd)`	affected	code_commit	—
`[266423e60ea1b953fcc0cd97f3dad85857e434d1,3b978fd0a3092b25561ac26bc1a87149fa981ddc)`	affected	code_commit	—
`[266423e60ea1b953fcc0cd97f3dad85857e434d1,b8535f5c77cc61352d02a0c038a280127a8b8208)`	affected	code_commit	—
`[266423e60ea1b953fcc0cd97f3dad85857e434d1,68ea6dd23b732081826c36033835468383487864)`	affected	code_commit	—
`[266423e60ea1b953fcc0cd97f3dad85857e434d1,727f043d699ab0d5d87122c2177f2b45fbe58d35)`	affected	code_commit	—
`[266423e60ea1b953fcc0cd97f3dad85857e434d1,32711f77db0641e57fd96fdc013bf1286b9f2514)`	affected	code_commit	—
`75278f1aff5e14c904d3503c6f836c42a7afb441`	affected	code_commit	—
`[5.10.89,5.10.270)`	affected	semver	—
`[5.15.12,5.15.221)`	affected	semver	—
`[5.4.175,5.5)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.16`	affected	generic	—
`[0,5.16)`	unaffected	generic	—
`[5.10.270,5.11.0)`	unaffected	semver	—
`[5.15.221,5.16.0)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*)`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a release that incorporates the patch removing the erroneous gpiochip_remove call
Reboot the system to load the updated, fixed kernel and drivers
If a kernel upgrade cannot be performed immediately, disable the bcm2835 pinctrl module in the boot configuration or unload it to avoid the buggy driver path

Generated by OpenCVE AI on October 1, 2026 at 17:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00196.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93274.mbox
https://git.kernel.org/stable/c/32711f77db0641e57fd96fdc013bf1286b9f2514
https://git.kernel.org/stable/c/3b978fd0a3092b25561ac26bc1a87149fa981ddc
https://git.kernel.org/stable/c/68ea6dd23b732081826c36033835468383487864
https://git.kernel.org/stable/c/727f043d699ab0d5d87122c2177f2b45fbe58d35
https://git.kernel.org/stable/c/b8535f5c77cc61352d02a0c038a280127a8b8208
https://git.kernel.org/stable/c/d428863ca8baa4e9eaf781266ac219b017dcf277
https://git.kernel.org/stable/c/dd6b1919e41d1260259c4505777be565fb3a7efd
https://git.kernel.org/stable/c/f494cfc254cd509d7cbc44b843e0a6602a520a33
https://nvd.nist.gov/vuln/detail/CVE-2026-93274
https://www.cve.org/CVERecord?id=CVE-2026-93274

History

Tue, 29 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93274.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-93274 https://www.cve.org/CVERecord?id=CVE-2026-93274
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Fri, 25 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Thu, 24 Sep 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devm_pinctrl_register() function fails, bcm2835_pinctrl_probe() calls gpiochip_remove() before gpiochip_add_data() has registered the GPIO chip. This means that upon failure the gpio_chip.gpiodev is NULL resulting in a null pointer dereference inside the gpiochip_remove() function. Remove the unnecessary function call to gpiochip_remove(). No GPIO cleanup is required because the GPIO chip has not yet been registered. Without this change there is potential for a kernel panic upon registration failure
Title		pinctrl: bcm2835: Don't remove an unregistered GPIO chip
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/32711f77db0641e57fd96fdc013bf1286b9f2514 https://git.kernel.org/stable/c/3b978fd0a3092b25561ac26bc1a87149fa981ddc https://git.kernel.org/stable/c/68ea6dd23b732081826c36033835468383487864 https://git.kernel.org/stable/c/727f043d699ab0d5d87122c2177f2b45fbe58d35 https://git.kernel.org/stable/c/b8535f5c77cc61352d02a0c038a280127a8b8208 https://git.kernel.org/stable/c/d428863ca8baa4e9eaf781266ac219b017dcf277 https://git.kernel.org/stable/c/dd6b1919e41d1260259c4505777be565fb3a7efd https://git.kernel.org/stable/c/f494cfc254cd509d7cbc44b843e0a6602a520a33

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-24T15:52:16.117Z

Updated: 2026-09-24T15:52:16.117Z

Reserved: 2026-09-17T16:02:15.098Z

Link: CVE-2026-93274

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-24T16:17:24.527

Modified: 2026-09-24T16:17:24.527

Link: CVE-2026-93274

Redhat

Severity : Low

Publid Date: 2026-09-24T00:00:00Z

Links: CVE-2026-93274 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T17:45:09Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object