In the Linux kernel, the following vulnerability has been resolved:

pinctrl: devicetree: don't free uninitialized dev_name on error path

dt_remember_or_free_map() duplicates dev_name for each map entry. If
kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps
entries, including entries that have not been initialized.

Some pinctrl drivers, including pinctrl-imx, allocate the map with
kmalloc() and leave dev_name for the core to initialize. The untouched
entries therefore contain uninitialized data which is passed to
kfree_const().

Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection
while binding the pinctrl-consuming device, under KASAN:

  BUG: KASAN: double-free in dt_free_map+0x34/0xa4
  Free of addr c425a900 by task init/1
   kfree from dt_free_map+0x34/0xa4
   dt_free_map from dt_remember_or_free_map+0x184/0x198
   dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8
   pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0

Initialize all dev_name fields to NULL before duplicating the device
name, making the full-map cleanup safe after a partial failure.

https://git.kernel.org/stable/c/015b5bcbcb622b32317642be91a7f79aa5413649

https://git.kernel.org/stable/c/321fe3584a8298386938130d138191aa35040b75

https://git.kernel.org/stable/c/929f6396baade89999ec8a1281232c101cbc727d

https://git.kernel.org/stable/c/9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d

https://git.kernel.org/stable/c/ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pinctrl/devicetree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"be4c60b563edee3712d392aaeb0943a768df7023","lessThan":"929f6396baade89999ec8a1281232c101cbc727d","versionType":"git","status":"affected"},{"version":"be4c60b563edee3712d392aaeb0943a768df7023","lessThan":"321fe3584a8298386938130d138191aa35040b75","versionType":"git","status":"affected"},{"version":"be4c60b563edee3712d392aaeb0943a768df7023","lessThan":"ad0ad3c228b6f76fde10f32047e0ec5fbc109dc8","versionType":"git","status":"affected"},{"version":"be4c60b563edee3712d392aaeb0943a768df7023","lessThan":"9d00a5ac7cd3d32ae61140f4b8a62f136de84e7d","versionType":"git","status":"affected"},{"version":"be4c60b563edee3712d392aaeb0943a768df7023","lessThan":"015b5bcbcb622b32317642be91a7f79aa5413649","versionType":"git","status":"affected"},{"version":"03f69244302d7954f42f528ea2d45903ebbf59f3","versionType":"git","status":"affected"},{"version":"77440c3a37203e3f4667d06e37f76ef3968d2d8c","versionType":"git","status":"affected"},{"version":"679c4f27b8958b65bb51d1c3dfdbf3befe4a33a3","versionType":"git","status":"affected"},{"version":"f88ac1330779c5bfdd79f7d7f7d4d3343c782f92","versionType":"git","status":"affected"},{"version":"f739a699db7d5a5cf39ca3ce2c84e4fe4a8f4c5d","versionType":"git","status":"affected"},{"version":"4.4.244","lessThan":"4.5","versionType":"semver","status":"affected"},{"version":"4.9.244","lessThan":"4.10","versionType":"semver","status":"affected"},{"version":"4.14.161","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.92","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.7","lessThan":"5.5","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pinctrl/devicetree.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.5","status":"affected"},{"version":"0","lessThan":"5.5","versionType":"semver","status":"unaffected"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc6","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]