Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: mips: cavium-octeon: Fixed missing ofnodeput in octeon2usbclocksstart We should call ofnodeput for the reference ‘uctlnode’ returned by ofgetparent, which will increase the refcount. Otherwise, there will be a refcount leak bug...

Astra Linux – vulnerability in linux-5.15, linux-6.1

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: benchmark: handle NUMANONODE correctly cpumaskofnode can be called for NUMANONODE inside domapbenchmark, resulting in the following sanitizer report: UBSAN: array-index-out-of-bounds in...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: PCI: microchip: Fix refcount leak in mcpcieinitirqdomains ofgetnextchild returns a node pointer with its refcount incremented; therefore, we should use ofnodeput on it when we no longer need it. mcpcieinitirqdomains calls ofnodep...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: net: mdiobus: fix unbalanced node reference count I received the following report while performing a devicemscc-miim load test with CONFIGOFUNITTEST and CONFIGOFDYNAMIC enabled: OF: ERROR: memory leak, expected refcount 1 instead...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adi-axi-adc: Fixed the refcount leak in adiaxiadcattachclient. The ofparsephandle function returns a node pointer with a refcount incremented. We should use ofnodeput on it when there is no longer a need for it. Add the...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: ASoC: samsung: Fix refcount leak in ariesaudioprobe ofparsephandle returns a node pointer with refcount incremented; we should use ofnodeput on it when done. If extconfindedevbynode fails, it does not call ofnodeput Calling...

PT-2026-97890

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tegra vip channel of parse function where the np variable is initialized from dev-of node without taking a reference. When endpoint parsing fails due to a malforme...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: Video: fbdev: amba-clcd: Fixed refcount leak issues. In clcdfbofinitdisplay, we should call ofnodeput for the references returned by ofgraphgetnextendpoint and ofgraphgetremoteportparent, as these references have increased the...

CVE-2026-68371

The CVE concerns the Linux kernel USB MUSB OMAP2430 driver. In omap2430_probe(), pdev->dev.of_node is stored in a local np variable as a borrowed pointer and the code later calls of_node_put(np). This drops a reference owned by the platform device, potentially leaving pdev->dev.of_node with...

CVE-2026-64301 regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()

In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix ofnode refcount leak in scmiregulatorprobe scmiregulatorprobe calls offindnodebyname which takes a reference on the returned device node. On the error path where processscmiregulatorofnode fails, the function...

SUSE CVE-2026-64246

In the Linux kernel, the following vulnerability has been resolved: power: reset: linkstation-poweroff: fix use-after-free in the linkstationpoweroffinit Move ofnodeputdn after the ofmatchnode call, which still needs the node pointer. The node reference is correctly released after use...

CVE-2026-64249 fpga: region: fix use-after-free in child_regions_with_firmware()

In the Linux kernel, the following vulnerability has been resolved: fpga: region: fix use-after-free in childregionswithfirmware Move ofnodeputchildregion after the error print to avoid accessing freed memory when prerr references childregion. Yilun: Fix the Fixes tag...

CVE-2026-63906

CVE-2026-63906 concerns the Linux kernel USB MUSB driver for the omap2430. The issue is a use-after-free in omap2430_probe() caused by calling of_node_put(np) prematurely before the last access to np, which can lead to a reference-count based crash if the node is freed while still in use. The doc...

CVE-2026-46288

In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-free in ofunittestchangeset The variable 'parent' is assigned the value of 'nchangeset' earlier in the function, meaning both point to the same struct devicenode. The call to ofnodeputnchangeset can...

EUVD-2026-32285

In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-free in testdrvprobe The function testdrvprobe retrieves the devicenode from the PCI device, applies an overlay, and then immediately calls ofnodeputdn. This releases the reference held by the PCI core...

EUVD-2026-32401

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: validate damosquotagoal-nid for nodememused,freebp Patch series "mm/damon/core: validate damosquotagoal-nid". nodememcgused,freebp DAMOS quota goals receive the node id. The node id is used for simeminfonode and...

CVE-2026-45989 of: unittest: fix use-after-free in testdrv_probe()

In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-free in testdrvprobe The function testdrvprobe retrieves the devicenode from the PCI device, applies an overlay, and then immediately calls ofnodeputdn. This releases the reference held by the PCI core...

PT-2026-43897

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11-1.1 Description A memory leak occurs in the EDAC/versalnet component within the mc probe function. The of parse phandle function returns a device node reference that requires release via of node put. The...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: rtc: gamecube: Fixed a refcount leak in gamecubertcreadoffsetfromsram. The offindcompatiblenode function returns a node pointer whose refcount is incremented. We should use ofnodeput on it after processing. Also, add the missing...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8195: Fixed error handling in mt8195mt6359rt1019rt5682devprobe. The devicenode pointer is returned by ofparsephandle, with the refcount incremented. We should use ofnodeput on it after the function is completed...