# CVE-2026-93274: Linux kernel bcm2835 pinctrl null pointer dereference

Source: https://junglewise.ai/threats/cve-2026-93274-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93274 · Severity: info · Published 2026-09-24

The Linux kernel's BCM2835 pinctrl driver contains a flaw in its initialization code that can cause the system to panic. When the pinctrl registration fails during device startup, the driver attempts to clean up a GPIO chip that was never registered, resulting in a null pointer access that crashes the kernel.

Technologies: [Linux](https://junglewise.ai/threats/technologies/linux-linux). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-93274 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93274 being exploited in the wild.

**How severe is CVE-2026-93274?** Informational severity, published 24 September 2026.

**Which products and versions are affected?** Linux multiple versions affected (see kernel git history).

**Is there a fix for CVE-2026-93274?** A patch was published on 2026-06-30. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-93274 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-93274?** Check whether you run Linux at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The bcm2835_pinctrl_probe() function calls gpiochip_remove() in its error path even when gpiochip_add_data() has not yet been called, causing gpiochip_remove() to dereference a NULL gpio_chip.gpiodev pointer. The vulnerability is a logic error in the cleanup sequence that triggers only when devm_pinctrl_register() fails. A fix removes the unnecessary gpiochip_remove() call since no GPIO cleanup is required for an unregistered chip.

## Affected products

- Linux Linux multiple versions affected (see kernel git history)

## Timeline

- 2026-09-24: disclosed
- 2026-06-30: patched

## References

- [https://git.kernel.org/stable/c/32711f77db0641e57fd96fdc013bf1286b9f2514](https://git.kernel.org/stable/c/32711f77db0641e57fd96fdc013bf1286b9f2514)
- [https://git.kernel.org/stable/c/3b978fd0a3092b25561ac26bc1a87149fa981ddc](https://git.kernel.org/stable/c/3b978fd0a3092b25561ac26bc1a87149fa981ddc)

## Related threats

- [Linux kernel use-after-free in conntrack helper](https://junglewise.ai/threats/cve-2026-98442-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel SMB client buffer overflow in symlink handling](https://junglewise.ai/threats/cve-2026-98318-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel nvmet-rdma queue resource leak](https://junglewise.ai/threats/cve-2026-98152-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel denial of service in IPv4 routing table allocation](https://junglewise.ai/threats/cve-2026-97598-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel null pointer dereference in SPI device matching](https://junglewise.ai/threats/cve-2026-93825-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)