CVE-2024-36959

What it actually does

Refcount leak occurs in pinctrl_dt_to_map() when propname buffer allocation fails after a reference count has been taken; the missing decrement leaves the device tree node reference held indefinitely.

Why it matters to the business

Kernel memory or object references are not released on error paths during pinctrl device-tree parsing, which can contribute to resource exhaustion, degraded stability, or unexpected kernel behavior on systems that process device trees.

How an attack unfolds

An attacker with local access supplies or triggers device-tree data that causes pinctrl_dt_to_map() to reach the propname allocation failure path, leaving an elevated reference count that may later be exploited for memory corruption or denial of service.

How to fix it

Update the Linux kernel to commit c470abd4fde40ea6a0846a2beab642a578c0b8cd or a later release that contains the fix; rebuild and deploy the corrected kernel image on all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit c470abd4fde40ea6a0846a2beab642a578c0b8cd; recompile a test device tree that forces the allocation failure and verify no reference leak is reported by kernel memory debug tools.

Typical attack path

1. Obtain local execution or the ability to influence device-tree loading
2. Trigger pinctrl device-tree parsing that exercises the allocation-failure branch in pinctrl_dt_to_map()
3. Observe or chain the leaked reference for subsequent memory-oriented attacks

How to detect it

Review kernel logs for pinctrl-related allocation failures around device-tree parsing; inspect for elevated reference counts on pinctrl device nodes using kernel debug interfaces after triggering the error path.

What your security team should do

• Prioritize kernel upgrades to the fixed commit across all Linux distributions and embedded devices
• Enable kernel memory debugging options (refcount tracking, KASAN) in test and staging environments to detect similar leaks
• Monitor upstream stable kernel releases for additional pinctrl or device-tree fixes