CVE-2024-46767

What it actually does

Missing of_node_put() after successful of_get_child_by_name() for LED nodes in the PHY subsystem leaves the device-tree reference count elevated, preventing the node from being freed.

Why it matters to the business

Long-running systems may experience gradual memory consumption in the kernel's device-tree handling when LED configurations are present; the issue is not known to be actively exploited and carries low exploitability probability.

How an attack unfolds

An attacker would need local access or the ability to trigger repeated PHY LED device-tree parsing paths; no public exploits, threat actors, or ransomware campaigns are associated with this reference-count leak.

How to fix it

Update to a kernel containing commit 26928c8f00f6bb0e194f3957fe51c69d36838eb2 or later; Woodpecker CI users should upgrade to version 2.7.0 or newer that incorporates the corrected kernel.

How to confirm the fix worked

Confirm the presence of commit 26928c8f00f6bb0e194f3957fe51c69d36838eb2 in the running kernel source; review dmesg or device-tree debug output for repeated LED node references without corresponding put operations.

Typical attack path

1. Obtain local code execution or kernel module loading capability
2. Trigger PHY LED initialization that calls of_get_child_by_name()
3. Observe gradual memory growth rather than immediate code execution or privilege escalation

How to detect it

Search kernel logs and device-tree initialization traces for repeated of_get_child_by_name calls on LED nodes without matching of_node_put; no specific exploitation artifacts are known.

What your security team should do

• Apply the referenced kernel commit or upgrade to Woodpecker 2.7.0 within normal patch cycles
• Monitor memory usage on systems that parse extensive PHY LED device-tree entries
• Include the fixed commit hash in automated kernel build and validation pipelines