CVE-2024-50197: pinctrl: intel: platform: fix error path in device_for_each_child_node()
Vulnerability summary
CVE-2024-50197 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.5% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 15 · Related 16Timeline
- 08-11-2024PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: pinctrl: intel: platform: fix error path in device_for_each_child_node() The device_for_each_child_node() loop requires calls to fwnode_handle_put() upon early returns to decrement the refcount of the child node and avoid leaking memory if that error path is triggered. There is one early returns within that loop in intel_platform_pinctrl_prepare_community(), but fwnode_handle_put() is missing. Instead of adding the missing call, the scoped version of the loop can be used to simplify the code and avoid mistakes in the future if new early returns are added, as the child node is only used for parsing, and it is never assigned.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
8%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.18% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu103 products
- linux< 6.8.0-56.58
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 6.8.0-1025.27
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ c5860e4a2737a8b29dc426c800d01c5be6aad811, < be3f7b9f995a6c2ee02767a0319929a2a98adf69 | ≥ c5860e4a2737a8b29dc426c800d01c5be6aad811, < 16a6d2e685e8f9a2f51dd5a363d3f97fcad35e22 | 6.8
- linux_kernel≥ 6.8, < 6.11.5 | 6.12:rc1 | 6.12:rc2 | 6.12:rc3
Debian1 product
- linux< 6.11.5-1
3 vendors · 106 products
