CVE-2026-46269

MediumCVSS 5.5/10Last modified Jul 22, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree

When probing the k230 pinctrl driver, the kernel triggers a NULL pointer dereference. The crash trace showed: [ 0.732084] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000068 [ 0.740737] ... [ 0.776296] epc : k230_pinctrl_probe+0x1be/0x4fc

In k230_pinctrl_parse_functions(), we attempt to retrieve the device pointer via info->pctl_dev->dev, but info->pctl_dev is only initialized after k230_pinctrl_parse_dt() completes.

At the time of DT parsing, info->pctl_dev is still NULL, leading to the invalid dereference of info->pctl_dev->dev.

Use the already available device pointer from platform_device instead of accessing through uninitialized pctl_dev.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
LinuxLinux>= d94a32ac688f953dc9a9f12b5b4139ecad841bbb, < 3c7d637bfc3dfbd6471c68bd767f7eb8b5b09eba; >= d94a32ac688f953dc9a9f12b5b4139ecad841bbb, < 1d0d361f4dbc2bb2003594f84e4b101fc6b508c0; >= d94a32ac688f953dc9a9f12b5b4139ecad841bbb, < d8c128fb6c2277d95f3f6a4ce28b82c8370031f6; 02c1deb1bff2b6d242e29a51e56107495979a2b8; 0ec03251d01494ef207089b5bd626becfd05fd86; >= 6.15.10, < 6.16; >= 6.16.1, < 6.17
LinuxLinux6.17

References

Timeline

Published
Jun 3, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-46277.2A vulnerability was found in D-Link DIR-825 and DIR-825R 1.0.5/4.5.1. Affected is the function handler_update_system_time of the file libdeuCVE-2026-462708.4In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-after-free in power_supply_changed() UsCVE-2026-462717.8In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: do WoW offloads only on primary link In case of multi-liCVE-2026-462724.7In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etr: Fix race condition between sysfs and perf mode WheCVE-2026-462738.6In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packets with small MSS Some physical adaptersCVE-2026-462747.8In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecessor is hashed in io_wq_remove_pending() CVE-2026-462757.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init patCVE-2026-462765.5In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix zero-size GDS range init on RDNA4 RDNA4 (GFX 12) hardwCVE-2026-462777.8In the Linux kernel, the following vulnerability has been resolved: mm/zone_device: do not touch device folio after calling ->folio_free() CVE-2026-462785.5In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix segfault when updating ftrace mask Fix invalid daCVE-2026-462797.8In the Linux kernel, the following vulnerability has been resolved: mm/alloc_tag: clear codetag for pages allocated before page_ext initialCVE-2026-46284.3A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint allows
CVE-2026-46269: Medium severity, CVSS 5.5 | Vulnix