CVE-2026-23337
published 2026-03-25CVE-2026-23337: In the Linux kernel, the following vulnerability has been resolved: pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config() In…
PriorityP416medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.12%
2.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
In pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns
directly. This bypasses the cleanup logic and results in a memory leak of
the cfg buffer.
Fix this by jumping to the out label on failure, ensuring kfree(cfg) is
called before returning.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.8-1 (forky) | linux 6.19.8-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 90a18c512884adb49ddc2fb30e94594169aae808 < 63ee429780a5d43b5b4406c6128109b0f47cf2f1 | 63ee429780a5d43b5b4406c6128109b0f47cf2f1 |
| linux | linux | >= 90a18c512884adb49ddc2fb30e94594169aae808 < 7a648d598cb8e8c62af3f0e020a25820a3f3a9a7 | 7a648d598cb8e8c62af3f0e020a25820a3f3a9a7 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.8-1 | 6.19.8-1 |
| linux | linux_kernel | >= 6.19.0 < 6.19.7 | 6.19.7 |
| linux | linux_kernel | >= 6.19.1 < 6.19.7 | 6.19.7 |
| lodash | lodash | >= 4.0.0 < 4.18.0 | 4.18.0 |
| lodash | lodash-es | >= 4.0.0 < 4.18.0 | 4.18.0 |
| lodash | lodash.template | >= 4.0.0 < 4.18.0 | 4.18.0 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
ghsa7.2HIGH
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
lodash vulnerable to Code Injection via `_.template` imports key names
ghsa·2026-04-01·CVSS 7.2
CVE-2026-4800 [HIGH] CWE-94 lodash vulnerable to Code Injection via `_.template` imports key names
lodash vulnerable to Code Injection via `_.template` imports key names
### Impact
The fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `options.imports` key names. Both paths flow into the same `Function()` constructor sink.
When an application passes untrusted input as `options.imports` key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.
Additionally, `_.template` uses `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are copied into the imports object and passed to `Function()`
OSV
CVE-2026-23337: In the Linux kernel, the following vulnerability has been resolved: pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config() In
osv·2026-03-25
CVE-2026-23337 CVE-2026-23337: In the Linux kernel, the following vulnerability has been resolved: pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config() In
In the Linux kernel, the following vulnerability has been resolved: pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config() In pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns directly. This bypasses the cleanup logic and results in a memory leak of the cfg buffer. Fix this by jumping to the out label on failure, ensuring kfree(cfg) is called before returning.
OSV
pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
osv·2026-03-25
CVE-2026-23337 pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
In pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns
directly. This bypasses the cleanup logic and results in a memory leak of
the cfg buffer.
Fix this by jumping to the out label on failure, ensuring kfree(cfg) is
called before returning.
GHSA
GHSA-5599-vj49-3fh3: In the Linux kernel, the following vulnerability has been resolved:
pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
I
ghsa_unreviewed·2026-03-25
CVE-2026-23337 GHSA-5599-vj49-3fh3: In the Linux kernel, the following vulnerability has been resolved:
pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
I
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
In pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns
directly. This bypasses the cleanup logic and results in a memory leak of
the cfg buffer.
Fix this by jumping to the out label on failure, ensuring kfree(cfg) is
called before returning.
Red Hat
lodash: lodash: Arbitrary code execution via untrusted input in template imports
vendor_redhat·2026-03-31·CVSS 7.2
CVE-2026-4800 [HIGH] CWE-94 lodash: lodash: Arbitrary code execution via untrusted input in template imports
lodash: lodash: Arbitrary code execution via untrusted input in template imports
Impact:
The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.
When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.
Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
Patches:
Users
Red Hat
kernel: pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
vendor_redhat·2026-03-25
CVE-2026-23337 [MEDIUM] CWE-772 kernel: pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
kernel: pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
In pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns
directly. This bypasses the cleanup logic and results in a memory leak of
the cfg buffer.
Fix this by jumping to the out label on failure, ensuring kfree(cfg) is
called before returning.
A flaw was found in the Linux kernel's pinctrl subsystem, specifically within the pinconf-generic module. This vulnerability occurs when the `pinconf_generic_parse_dt_config()` function fails to properly deallocate memory, bypassing the intended cleanup logic. This oversight results in a memory leak, w
Debian
CVE-2026-23337: linux - In the Linux kernel, the following vulnerability has been resolved: pinctrl: pi...
vendor_debian·2026
CVE-2026-23337 [LOW] CVE-2026-23337: linux - In the Linux kernel, the following vulnerability has been resolved: pinctrl: pi...
In the Linux kernel, the following vulnerability has been resolved: pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config() In pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns directly. This bypasses the cleanup logic and results in a memory leak of the cfg buffer. Fix this by jumping to the out label on failure, ensuring kfree(cfg) is called before returning.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.19.8-1)
sid: resolved (fixed in 6.19.8-1)
trixie: resolved
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-23337 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-23337 [MEDIUM] CVE-2026-23337 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23337 :
Linux Debian vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
In pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns
directly. This bypasses the cleanup logic and results in a memory leak of
the cfg buffer.
Fix this by jumping to the out label on failure, ensuring kfree(cfg) is
called before returning.
Source : NVD
Published March 25, 2026
CNA Score N/A
Affected Technologies
Linux Debian
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6.5
Exploitation Probability (EPSS) N/A
Affected packages and libraries
linux
Bugzilla
CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports
bugzilla·2026-03-31·CVSS 7.2
CVE-2026-4800 [HIGH] CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports
CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports
Impact:
The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.
When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.
Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function()
Bugzilla
CVE-2024-23337 jq: jq has signed integer overflow in jv.c:jvp_array_write [fedora-42]
bugzilla·2025-06-04·CVSS 6.5
CVE-2024-23337 [MEDIUM] CVE-2024-23337 jq: jq has signed integer overflow in jv.c:jvp_array_write [fedora-42]
CVE-2024-23337 jq: jq has signed integer overflow in jv.c:jvp_array_write [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2367807
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from releases that are no longer
maintained. At that time this bug will be closed as EOL if it remains open with a
'version' of '42'.
Pa
2026-03-25
Published