CVE-2017-18174

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-02-11 · updated 2026-06-17
Weakness: CWE-415

Description

In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free.

Affected products

Linux kernel: before 4.7 — fixed in 4.7

How to fix

Upgrade to a fixed version: Linux kernel 4.7. Check the vendor advisory for mitigations.

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=251e22abde21833b3d29577e4d8c7aaccd650eee
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8dca4a41f1ad65043a78c2338d9725f859c8d2c3
https://github.com/torvalds/linux/commit/251e22abde21833b3d29577e4d8c7aaccd650eee
https://github.com/torvalds/linux/commit/8dca4a41f1ad65043a78c2338d9725f859c8d2c3
https://usn.ubuntu.com/3848-1/
https://usn.ubuntu.com/3848-2/
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=251e22abde21833b3d29577e4d8c7aaccd650eee
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8dca4a41f1ad65043a78c2338d9725f859c8d2c3
https://github.com/torvalds/linux/commit/251e22abde21833b3d29577e4d8c7aaccd650eee
https://github.com/torvalds/linux/commit/8dca4a41f1ad65043a78c2338d9725f859c8d2c3
https://usn.ubuntu.com/3848-1/
https://usn.ubuntu.com/3848-2/

Get alerted when CVE-2017-18174 or the next vulnerability affects your stack