CVE-2026-89504

What it actually does

A use-after-free in the Linux kernel AMS/AS3722 regulator driver occurs when as3722_get_regulator_dt_data() stores an of_get_child_by_name() device-tree node on pdev->dev.of_node and then immediately calls of_node_put(), dropping the reference while the platform device still points at it. Later kernel paths that walk or dereference that of_node (regulator registration, DT helpers, sysfs) can touch freed memory, causing kernel oops, heap corruption, or local privilege escalation on hosts that probe this PMIC driver.

Why it matters to the business

Impact is limited to Linux systems that actually load the AS3722 regulator driver (typically embedded, mobile, and industrial boards with that PMIC), not general-purpose servers without the hardware. A successful exploit can take down the host or fully compromise it from local context, disrupting availability and any workloads on the device. Predicted exploitation is very low (EPSS about 0.14% and flat over 30 days), the issue is not in CISA KEV, is not associated with ransomware, and exploit maturity is none about 32 days after publication—so this is a high-severity local kernel bug to fold into the normal vendor kernel patch cycle rather than an internet-facing emergency.

How an attack unfolds

An attacker needs local access on a Linux system whose device tree includes the AS3722 regulator node so the as3722 driver probes. During as3722_get_regulator_dt_data(), the driver takes a DT child node, assigns it to the platform device, then releases it, leaving a dangling of_node pointer. The attacker then induces later kernel use of that pointer (further regulator/DT operations or device attribute access) so the kernel reads or writes freed memory. This class of kernel UAF can be turned into arbitrary kernel memory corruption and full host control, but no public exploit, proof-of-concept, named APT, or ransomware campaign is known, and exploit maturity remains none.

How to fix it

Apply the upstream Linux kernel fix that removes the premature of_node_put(np) in as3722_get_regulator_dt_data() so the device keeps the of_node reference for its lifetime. Upgrade to a distribution or OEM kernel that includes that commit. No per-package fixed versions were published with this advisory, so track linux-stable and your vendor kernel changelog for the AS3722 regulator DT-data fix. If a patched kernel is not yet available, do not load the as3722 regulator driver on systems that do not need that PMIC, and restrict untrusted local code until the kernel is updated.

How to confirm the fix worked

Confirm the running or packaged kernel contains the fix: in source or changelog, as3722_get_regulator_dt_data() must assign the child node to the device and must not of_node_put that same node. On live hosts, check whether the as3722 regulator driver is present or loaded, and review kernel logs for a clean probe without of_node or KASAN use-after-free reports. Rebuild or reimage after upgrade and re-check module/kernel version against the vendor advisory.

Typical attack path

1. Gain local execution or the ability to cause kernel driver probe on a Linux host that instantiates the AS3722 regulator from device tree
2. Wait for or trigger as3722_get_regulator_dt_data() so the of_node is assigned to the platform device and then released
3. Cause subsequent kernel use of the dangling pdev->dev.of_node via regulator, DT, or sysfs paths
4. Convert the use-after-free into kernel memory corruption and, if successful, privilege escalation or kernel code execution
5. Abuse kernel privileges for persistence, data access, or further compromise of the device

How to detect it

This is a local kernel use-after-free at driver probe, not a network service bug, so look for host artifacts rather than traffic. Review dmesg, journalctl --dmesg / journalctl -k, pstore, kdump/vmcore, and KASAN/KFENCE reports around AS3722 regulator probe for oops or use-after-free in of_node handling. Search crash stacks for as3722_get_regulator_dt_data, as3722 regulator paths, and of_* helpers after probe. There are no named threat actors or ransomware playbooks for this CVE; a single oops at boot or module load is more likely a reliability hit than confirmed exploitation, while a KASAN use-after-free followed by unusual root-level activity would be more suspicious.

• as3722_get_regulator_dt_data
• as3722
• regulator-as3722
• KASAN: use-after-free
• BUG: KASAN: use-after-free
• Unable to handle kernel paging request
• of_node_put
• Call Trace:
• as3722

What your security team should do

• Inventory Linux images and fleets that ship or load the AS3722 regulator driver and prioritize those for kernel updates
• Apply vendor or linux-stable kernels that include the as3722_get_regulator_dt_data of_node_put fix; there is no KEV due date, so use the normal high-severity local-kernel SLA
• Until patched, blacklist or avoid loading the as3722 regulator module on systems that do not require that PMIC, and limit local untrusted access
• Watch kernel oops, panic, and KASAN telemetry for as3722 / of_node use-after-free; no in-the-wild or ransomware use is reported
• Do not treat this as a mass remote worm: EPSS is low and flat, exploit maturity is none, and exposure is hardware- and DT-specific