Device Node Reference Leak in Linux bq257xx Regulator Module

Publication date: 2026-03-25

Last updated on: 2026-04-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio() In bq257xx_reg_dt_parse_gpio(), if fails to get subchild, it returns without calling of_node_put(child), causing the device node reference leak.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-25

Last Modified

2026-04-23

Generated

2026-07-06

AI Q&A

2026-03-25

EPSS Evaluated

2026-07-05

NVD

CVE-2026-23314

EUVD

EUVD-2026-15258

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.18
linux	linux_kernel	From 6.18.1 (inc) to 6.18.17 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.7 (exc)
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel within the bq257xx regulator driver. Specifically, in the function bq257xx_reg_dt_parse_gpio(), if the function fails to get a subchild device node, it returns without properly releasing the reference to the device node by not calling of_node_put(child). This causes a device node reference leak.

Impact Analysis

The impact of this vulnerability is a device node reference leak in the Linux kernel. This could potentially lead to resource leaks, which might degrade system performance or stability over time if the leaked references accumulate.

Hi! I’m here to help you understand CVE-2026-23314. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70