CVE-2024-36959: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-36959 affects the Linux kernel's pinctrl devicetree subsystem. The vulnerability was discovered on May 30, 2024, and involves a reference count leak in the pinctrl_dt_to_map() function. This issue occurs when there is a failure to allocate the propname buffer, requiring proper handling of the reference count (NVD).

The vulnerability is a reference count leak in the Linux kernel's pinctrl devicetree subsystem. Specifically, when the pinctrl_dt_to_map() function fails to allocate the propname buffer, it needs to properly drop the reference count that was just taken. The fix involves calling pinctrl_dt_free_maps() directly since it includes the dropping operation. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability could lead to a reference count leak in the Linux kernel, potentially causing system resource exhaustion. The CVSS score indicates that while the vulnerability requires local access and low privileges, it could result in high availability impact to the affected system (NVD).

The vulnerability requires local access with low privileges and no user interaction. The attack complexity is low, indicating that the exploitation conditions are straightforward (NVD).

The vulnerability has been fixed in various Linux kernel versions. Ubuntu has released patches for multiple versions including 24.04 LTS (6.8.0-40.40), 22.04 LTS (5.15.0-118.128), and 20.04 LTS (5.4.0-192.212). Debian has also released fixes in version 5.10.218-1~deb10u1 for Debian 10 buster (Ubuntu, Debian).