CVE-2026-64301

Analyzed Analyzed - Analysis Complete

Reference Leak in Linux Kernel SCMI Regulator Driver

Publication date: 2026-07-25

Last updated on: 2026-09-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() scmi_regulator_probe() calls of_find_node_by_name() which takes a reference on the returned device node. On the error path where process_scmi_regulator_of_node() fails, the function returns without calling of_node_put() on the child node, leaking the reference. Add of_node_put(np) on the error path to properly release the reference.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-03

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64301

EUVD

EUVD-2026-49013

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a reference count leak in the Linux kernel's SCMI regulator driver. The function scmi_regulator_probe() uses of_find_node_by_name() which increments the reference count of a device node. If process_scmi_regulator_of_node() fails, the function exits without decrementing the reference count, causing a memory leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's regulator subsystem and involves a reference count leak in the SCMI regulator probe function. Detection requires checking kernel logs for errors related to regulator or SCMI operations or inspecting kernel source code for the affected function.

Impact Analysis

This vulnerability could lead to resource exhaustion in the Linux kernel, potentially causing system instability or crashes. It may affect systems using SCMI-based regulators, though the impact depends on the specific configuration and usage.

Compliance Impact

This vulnerability involves a reference count leak in the Linux kernel's SCMI regulator driver, which could lead to resource exhaustion or instability. It does not directly impact data privacy or security controls required by GDPR or HIPAA, as it is not a data exposure or access control flaw.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the reference count leak in scmi_regulator_probe(). Monitor kernel logs for regulator or SCMI-related errors after patching.

Hi! I’m here to help you understand CVE-2026-64301. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70