Linux Kernel Pinmux NULL Pointer Dereference Vulnerability

A vulnerability in the Linux kernel's pinmux handling can lead to a NULL pointer dereference. This issue arises when two clients of the same GPIO call pinctrl_select_state() for the same functionality. Process A may update the pin's mux_usecount but not the mux_owner, allowing process B to see the updated usecount and attempt to access the mux_owner, resulting in a crash. The vulnerability can be exploited by serializing access to mux-related settings with a mutex lock.

Impact

Exploitation of this vulnerability causes a NULL pointer dereference, leading to a crash of the affected process.