CVE-2026-68371

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

omap2430_probe() is reached only via the local driver model - boot-time platform bus match on the OMAP MUSB device-tree node, deferred-probe retries, sysfs bind/unbind of musb-omap2430, or module load/unload. There is no network, adjacent-network, or remote path, and leveraging the prematurely released kobject name/OF node requires local heap manipulation in the same kmalloc cache.

AC:LAttack complexity, low

The stray of_node_put(np) is unconditional on both the success return and the err_put_musb error path, so every probe invocation drops a reference the driver never took. There is no race to win, no timing window, and no memory-layout precondition; the imbalance occurs deterministically on each probe and reproduces at will through bind/unbind cycles.

PR:NPrivileges required, none

No credential, capability, or namespace check exists on the path - the platform bus binds the OMAP MUSB node and drops the reference during kernel boot, before any user session exists, so the underflowed device_node state arises with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not needed for the vulnerable condition to occur.

UI:NUser interaction, none

The musb-omap2430 platform driver binds automatically when the device-tree node is populated, and deferred-probe retries run unattended during boot; no administrator action, victim interaction, mount, or file open is required for the unbalanced of_node_put() to execute.

S:UScope, unchanged

The corrupted struct device_node, its embedded kobject, and the OF tree all belong to the kernel's own security authority, and the faulting code runs in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

The premature release drives kobject_cleanup(), which kfree_const()s kobj->name while the device_node stays reachable via pdev->dev.of_node, the OF tree, and phandle lookups, so later kobject_name()/sysfs/%pOF accesses read back reclaimed heap contents an attacker can spray. The bad of_node_put() splat with dump_stack() additionally leaks kernel pointers and a full stack trace.

I:HIntegrity impact, high

A device_node whose backing kobject has been released and whose slab-allocated name has been freed yields write primitives once the memory is reclaimed: the embedded fwnode_handle.ops table is dereferenced by fwnode_call_int_op(), kobj.ktype->release is invoked on the next put, and the parent/child/sibling and device-link list heads permit list-manipulation writes during OF tree operations.

A:HAvailability impact, high

Reaching zero produces "ERROR: of_node_release() detected bad of_node_put()" with dump_stack(), and the next get/put triggers a refcount_t underflow; use-after-free WARN - an outright panic under panic_on_warn. __kobject_del() also tears down the node's /sys/firmware/devicetree entries and cascades puts onto the parent node, and dereferencing the released node oopses the kernel.