CVE-2024-50071

What it actually does

Double free in ma35_pinctrl_dt_node_to_map_func() because devm_kcalloc() auto-frees 'new_map' on device removal while pinconf_generic_dt_free_map() also calls pinctrl_utils_free_map().

Why it matters to the business

Kernel crashes or potential local code execution on Linux systems can cause service outages, data corruption, and require emergency reboots or rollbacks across servers and embedded devices.

How an attack unfolds

An attacker with local access crafts or triggers a device-tree node that invokes ma35_pinctrl_dt_node_to_map_func(), causing the double-free condition that may be leveraged for memory corruption or denial of service.

How to fix it

Upgrade Linux kernel to version 6.11.5 or later; apply commit 6441d9c3d71b59c8fd27d4e381c7471a32ac1a68; rebuild and reboot affected systems.

How to confirm the fix worked

Verify running kernel version is 6.11.5 or newer; confirm source contains kcalloc() instead of devm_kcalloc() in the pinctrl nuvoton driver; test device-tree loading and removal paths.

Typical attack path

1. Obtain local access or execute code on the target Linux system
2. Trigger pinctrl device-tree parsing that reaches ma35_pinctrl_dt_node_to_map_func()
3. Force device removal or cleanup path to execute both free operations
4. Exploit resulting memory corruption for privilege escalation or crash

How to detect it

Review kernel logs for oops or panic messages referencing pinctrl, nuvoton, or ma35_pinctrl_dt_node_to_map_func; inspect device-tree load/unload sequences around crash times.

What your security team should do

• Immediately upgrade all Linux kernels to 6.11.5 or fixed backports
• Prioritize systems exposed to local users or device-tree configuration
• Monitor for kernel oops/panic reports involving pinctrl after patching