{"id":"CVE-2026-93274","title":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: bcm2835: Don't remove an unregistered GPIO chip\n\nIf the devm_pinctrl_register() function fails,\nbcm2835_pinctrl_probe() calls gpiochip_remove()\nbefore gpiochip…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: bcm2835: Don't remove an unregistered GPIO chip\n\nIf the devm_pinctrl_register() function fails,\nbcm2835_pinctrl_probe() calls gpiochip_remove()\nbefore gpiochip…","severity":"medium","vendor":"Linux","product":"Linux","affected":["Linux >= ba696b470839d70c6b8290c1f798bac7fb2a584c < d428863ca8baa4e9eaf781266ac219b017dcf277","Linux >= 79c6d4fa1be1fd0819c50ebb4dee101bbbc4d20e < f494cfc254cd509d7cbc44b843e0a6602a520a33","Linux >= 266423e60ea1b953fcc0cd97f3dad85857e434d1 < dd6b1919e41d1260259c4505777be565fb3a7efd","Linux >= 266423e60ea1b953fcc0cd97f3dad85857e434d1 < 3b978fd0a3092b25561ac26bc1a87149fa981ddc","Linux >= 266423e60ea1b953fcc0cd97f3dad85857e434d1 < b8535f5c77cc61352d02a0c038a280127a8b8208","Linux >= 266423e60ea1b953fcc0cd97f3dad85857e434d1 < 68ea6dd23b732081826c36033835468383487864","Linux >= 266423e60ea1b953fcc0cd97f3dad85857e434d1 < 727f043d699ab0d5d87122c2177f2b45fbe58d35","Linux >= 266423e60ea1b953fcc0cd97f3dad85857e434d1 < 32711f77db0641e57fd96fdc013bf1286b9f2514","Linux 75278f1aff5e14c904d3503c6f836c42a7afb441","Linux >= 5.10.89 < 5.10.270","Linux >= 5.15.12 < 5.15.221","Linux >= 5.4.175 < 5.5","Linux 5.16"],"published":"2026-09-24","updated":"2026-09-24","sourceUpdated":"2026-09-24T16:17:24.527","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93274","references":[{"url":"https://git.kernel.org/stable/c/32711f77db0641e57fd96fdc013bf1286b9f2514","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b978fd0a3092b25561ac26bc1a87149fa981ddc","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68ea6dd23b732081826c36033835468383487864","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/727f043d699ab0d5d87122c2177f2b45fbe58d35","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8535f5c77cc61352d02a0c038a280127a8b8208","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d428863ca8baa4e9eaf781266ac219b017dcf277","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd6b1919e41d1260259c4505777be565fb3a7efd","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f494cfc254cd509d7cbc44b843e0a6602a520a33","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93274.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-93274"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2540310"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93274"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93274"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93274.mbox"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ingestedAt":"2026-09-24T16:47:15.840Z","epss":0.00201,"epssPercentile":0.0997,"cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-476"],"slug":"CVE-2026-93274","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: bcm2835: Don't remove an unregistered GPIO chip\n\nIf the devm_pinctrl_register() function fails,\nbcm2835_pinctrl_probe() calls gpiochip_remove()\nbefore gpiochip_add_data() has registered the GPIO chip.\n\nThis means that upon failure the gpio_chip.gpiodev\n is NULL resulting in a null pointer dereference\ninside the gpiochip_remove() function.\n\nRemove the unnecessary function call to gpiochip_remove().\nNo GPIO cleanup is required because the GPIO chip\nhas not yet been registered. Without this change there\nis potential for a kernel panic upon registration failure\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93274.json)","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224219,"id":"CVE-2026-93274","ts":1792325022149,"field":"cvss","old":null,"new":"5.5"},{"seq":224218,"id":"CVE-2026-93274","ts":1792325022149,"field":"severity","old":"none","new":"medium"}]}