Cloudanix VulnDB

CVE-2026-68371

High · 8.4

CVSS

8.4

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A mistake in how the system manages internal references to hardware configuration data can cause crashes or memory problems on certain Linux devices.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Incorrect of_node_put on a borrowed device tree node pointer in omap2430_probe leads to unbalanced reference counts and potential use-after-free on the platform device node.

Why it matters to the business

Kernel instability, crashes, or memory corruption on affected embedded Linux devices can interrupt hardware operation and require reboots or system recovery.

How an attack unfolds

An attacker with local access triggers the omap2430 USB probe path, causing the kernel to decrement a reference it does not own and later dereference the node after it may have been freed or repurposed.

How to fix it

Apply the upstream fix that removes the erroneous of_node_put calls from omap2430_probe; rebuild and deploy the corrected kernel image to all affected devices.

How to confirm the fix worked

Inspect the omap2430.c source for the probe function to confirm of_node_put(np) calls on the borrowed pdev->dev.of_node have been removed; boot the updated kernel and verify normal USB device enumeration without reference-count warnings.

Typical attack path

  1. Obtain local code execution on the target system
  2. Trigger USB or platform device enumeration that invokes omap2430_probe
  3. Force repeated probe success/error paths to unbalance the of_node reference count
  4. Trigger subsequent device tree operations that dereference the now-invalid node

How to detect it

Review kernel logs and dmesg for reference-count imbalance warnings or use-after-free reports involving omap2430 or of_node operations around USB device probe events.

What your security team should do

  • Prioritize kernel update for any systems using the omap2430 musb driver
  • Add the corrected driver to automated build and deployment pipelines
  • Monitor kernel logs for of_node reference count warnings during device bring-up

The record

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed of_node in probe omap2430_probe() stores pdev->dev.of_node in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it. The success and error paths nevertheless call of_node_put(np). This drops a reference that is owned by the platform device, and can leave pdev->dev.of_node with an unbalanced reference count. Do not put the borrowed platform device node from omap2430_probe(). References taken for the child MUSB device are handled by the device core, and the ctrl-module phandle reference is still released separately.

Affected packages

Ecosystem Package Introduced Fixed