CVE-2024-46685

What it actually does

The pinctrl-single driver calls pinmux_generic_get_function() which may return NULL and then immediately dereferences the returned pointer without a NULL check, resulting in a kernel NULL pointer dereference.

Why it matters to the business

Systems running affected kernel versions may experience unexpected crashes or denial of service when pin control operations are performed, increasing operational risk especially on devices using the pinctrl-single driver.

How an attack unfolds

An attacker with local access triggers pinmux operations that invoke pcs_get_function() under conditions where pinmux_generic_get_function() returns NULL, causing the kernel to dereference an invalid pointer and panic.

How to fix it

Update the Linux kernel to a version containing commit 0a2bab5ed161318f57134716accba0a30f3af191 or later; apply the corresponding stable or distribution backport for the running kernel series.

How to confirm the fix worked

Confirm the running kernel contains the fix commit, review the pcs_get_function() implementation for an explicit NULL check on the function pointer, and test pin control operations on affected hardware.

Typical attack path

1. Obtain local code execution on the target system
2. Perform pin control or GPIO configuration operations that reach pcs_get_function()
3. Trigger the code path where pinmux_generic_get_function() returns NULL
4. Kernel dereferences the NULL pointer and crashes

How to detect it

Review kernel logs for NULL pointer dereference oops messages originating from pinctrl-single or pcs_get_function; correlate with recent pin-control or GPIO configuration activity.

What your security team should do

• Prioritize kernel updates on all systems using the pinctrl-single driver
• Monitor vendor and distribution advisories for backported fixes
• Restrict local access and pin-control privileges where possible until patched