CVE-2026-90298

What it actually does

Reference count leak in the sun4i DRM TCON driver caused by of_find_device_by_node() acquiring a device reference that is never released after successful mux configuration.

Why it matters to the business

Long-running systems using affected Allwinner-based hardware may experience gradual resource exhaustion or unexpected driver behavior under sustained load.

How an attack unfolds

An attacker with local access crafts workloads or device configurations that repeatedly trigger the TCON mux path; each successful configuration leaks a reference, eventually leading to memory pressure or corruption that can be leveraged for privilege escalation.

How to fix it

Update to a Linux kernel containing the fix that explicitly drops the device reference after mux configuration succeeds; rebuild and deploy the kernel image on affected systems.

How to confirm the fix worked

Inspect the sun4i_tcon driver source for the presence of the put_device() or equivalent release call immediately after successful mux configuration; verify the change via kernel build logs or git history.

Typical attack path

1. Obtain local code execution on a Linux system with the sun4i DRM driver loaded
2. Trigger repeated TCON TOP device node lookups via graphics or display operations
3. Accumulate unreleased device references until kernel memory state is corrupted or exhausted
4. Exploit resulting memory corruption to gain elevated privileges

How to detect it

Review kernel logs for repeated sun4i TCON initialization messages without corresponding cleanup; correlate with memory usage anomalies or oops reports referencing tcon or of_find_device_by_node.

What your security team should do

• Prioritize kernel updates for any systems exposing the sun4i DRM driver
• Monitor EPSS and exploit maturity indicators for changes
• Apply defense-in-depth by restricting unprivileged local access where possible