CVE-2023-52571

What it actually does

Refcount leak in the rk817 power supply driver probe function where of_node_put() is missing on error return paths and at driver removal, leaving device node references unbalanced.

Why it matters to the business

Gradual resource exhaustion on systems using the RK817 PMIC can lead to degraded stability or eventual kernel memory pressure after repeated driver load/unload cycles; urgency remains low given the niche hardware and absence from KEV or ransomware campaigns.

How an attack unfolds

An attacker with local access triggers repeated probe failures or module reloads against the rk817 driver; each failure leaks a reference without decrementing it, accumulating until system resources are exhausted.

How to fix it

Upgrade the Linux kernel to a fixed version containing commit fe6406238d5a24e9fb0286c71edd67b99d8db58d; for the 6.1 stable series this is 6.1.56 or later.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking git commit fe6406238d5a or verifying of_node_put() calls exist on every error path in drivers/power/supply/rk817_charger.c; recompile and boot-test on affected hardware.

Typical attack path

1. Obtain local access on a system exposing the rk817 power supply driver
2. Induce probe error conditions or unload/reload the module repeatedly
3. Accumulate unreleased of_node references over many cycles
4. Observe gradual memory pressure or driver instability

How to detect it

Review kernel logs for repeated rk817 probe failures; inspect /proc/meminfo or slabinfo for growing device_node or of_node allocations correlated with driver activity; no public exploit artifacts exist.

What your security team should do

• Apply the kernel update to 6.1.56+ or equivalent on all systems using RK817 hardware within normal patch windows
• Monitor memory usage on affected devices for unexpected growth after driver reloads
• Prioritize the update only for devices exposing the rk817 driver; no immediate action required for unrelated hardware