The Linux kernel vulnerability involves the pinctrl subsystem's pinconf-generic component, specifically the pinconf_generic_parse_dt_pinmux() function. It assumed the 'pinmux' property was non-empty if present, but this assumption was incorrect. When the property was empty, the allocator returned a special non-NULL value that led to a crash when the kernel tried to access invalid memory. The fix implemented fully validates the 'pinmux' property's value, including its length, to prevent this invalid memory access and subsequent crash. This vulnerability affects Linux kernel versions before 7.0.0-28.28.1 and impacts multiple Ubuntu LTS releases and variants.

The vulnerability can cause a denial of service (kernel crash) due to invalid memory access when processing an empty 'pinmux' property in device tree data. There is no impact on confidentiality or integrity. The attack vector requires local access with low privileges. No known exploits are reported in the wild.

A fix is available in Linux kernel version 7.0.0-28.28.1 and later. Users should update their Linux kernel to this version or newer to resolve the vulnerability. Since this is not a cloud service, remediation requires applying the official kernel update provided by the vendor or distribution. Patch status is confirmed by the affectedVersions field indicating the fix in 7.0.0-28.28.1.