CVE-2026-93274 pinctrl: bcm2835: Don't remove an unregistered GPIO chip
A null pointer dereference in the BCM2835 pinctrl driver can cause a kernel panic if GPIO registration fails, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93274?
CVE-2026-93274 is a vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: bcm2835: Don't remove an unregistered GPIO chip
If the devm_pinctrl_register() function fails, bcm2835_pinctrl_probe() calls gpiochip_remove() before gpiochip_add_data() has registered the GPIO chip.
This means that upon failure the gpio_chip.gpiodev is NULL resulting in a null pointer dereference inside the gpiochip_remove() function.
Remove the unnecessary function call to gpiochip_remove(). No GPIO cleanup is required because the GPIO chip has not yet been registered. Without this change there is potential for a kernel panic upon registration failure
Which versions are affected by CVE-2026-93274?
How do I fix CVE-2026-93274?
Apply the vendor's patch.
Is CVE-2026-93274 being exploited?
There is no known exploitation of CVE-2026-93274 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-93274, DEBIAN-CVE-2026-93274, GHSA-6v4f-r38f-j6j4, UBUNTU-CVE-2026-93274.