CVE-2026-23337: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23337 is a memory leak vulnerability in the Linux kernel's pinctrl subsystem, specifically within the pinconf_generic_parse_dt_config() function in drivers/pinctrl/pinconf-generic.c. When parse_dt_cfg() fails, the function returns directly without executing cleanup logic, causing the cfg buffer to be leaked. The vulnerability affects Linux kernel versions from 6.19.1 up to (but not including) 6.19.7, as well as Linux kernel 7.0 release candidates (rc1 through rc7). It was disclosed on March 25, 2026, with patches available shortly after. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-772 (Missing Release of Resource after Effective Lifetime). In pinconf_generic_parse_dt_config(), a cfg buffer is allocated prior to calling parse_dt_cfg(); if that call fails, the function returns immediately, bypassing the out label where kfree(cfg) is invoked. The fix redirects the failure path to jump to the out label, ensuring proper memory deallocation before returning. Exploitation requires local access with low privileges, as the vulnerable code path is triggered during device tree configuration parsing in the kernel's pin control subsystem (Red Hat Bugzilla, Red Hat Advisory).

Repeated triggering of this memory leak can progressively exhaust kernel memory resources, potentially leading to a denial of service (DoS) condition on affected systems. There is no impact on confidentiality or integrity — only availability is affected. Systems running affected Linux kernel versions with pinctrl functionality (e.g., embedded or SoC-based platforms relying on device tree pin configuration) are at risk (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, further limiting the practical attack surface (Red Hat Advisory).

Apply the upstream kernel patches that fix the memory leak by redirecting the failure path in pinconf_generic_parse_dt_config() to the out label, ensuring kfree(cfg) is called. Fixed versions include Linux kernel 6.19.7 and the mainline 7.0-rc3 (and later). Administrators should update to a patched kernel version as soon as possible and monitor kernel memory usage on affected systems for signs of memory exhaustion in the interim (Red Hat Bugzilla, Kernel Patch 1, Kernel Patch 2).