NULL Pointer Dereference in Canaan K230 Pinctrl Driver

CVE-2026-46269

What is CVE-2026-46269?

A vulnerability exists in the K230 Pinctrl driver within the Linux kernel, which can lead to a NULL pointer dereference during device tree parsing. Specifically, when the driver called k230_pinctrl_probe, it attempted to access an uninitialized device pointer, causing a system crash. This issue arises due to improper handling of the device initialization sequence, where the device pointer is only set after parsing the device tree. By ensuring access to the device pointer from the platform device, rather than relying on an uninitialized structure, this vulnerability can be mitigated.

References