This CVE exposes a contract mismatch between pinctrl core cleanup code and driver initialization assumptions. The pinctrl-imx driver pre-allocates its pin map array via kmalloc() but leaves the dev_name fields uninitialized, trusting the core to populate them during iteration. Meanwhile, the error path in dt_remember_or_free_map() assumes that any non-NULL dev_name is a valid pointer to free — it has no way to distinguish between a driver that legitimately didn't allocate a name versus one that left garbage in uninitialized memory. When kstrdup_const() fails partway through processing, the cleanup routine operates on entries containing whatever residual data happened to be in that memory location.
The practical impact is limited: triggering this requires artificial memory pressure (failslab injection) during device binding, and the EPSS score reflects that low-probability trigger condition. However, the structural lesson matters more than the exploitability. The pattern of driver pre-allocation followed by core population is used across multiple subsystems, and if this mismatch survived in pinctrl-imx for years, similar contract violations likely exist elsewhere.
The fix — zero-initializing the map array before population — is trivial, which is itself instructive. Trivial fixes for latent bugs that persist in stable code typically indicate the failure mode wasn't being tested, not that the bug was too obscure to notice. Error paths in cleanup code are notoriously under-tested because they require allocation failures to execute.
For defenders: audit any driver that pre-allocates structures later populated by core code, then cleaned up by bulk error paths. The key question isn't whether the driver's initialization is correct in isolation — it's what assumptions the cleanup path makes about initialization state. Where drivers rely on uninitialized memory being safe, ensure the map structure is zero-initialized before population begins. This applies to any subsystem where drivers pre-allocate state that core code fills in and later frees on error.