CVE-2026-68371

Received Received - Intake

Reference Leak in Linux Kernel USB musb OMAP2430 Driver

Publication date: 2026-08-10

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed of_node in probe omap2430_probe() stores pdev->dev.of_node in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it. The success and error paths nevertheless call of_node_put(np). This drops a reference that is owned by the platform device, and can leave pdev->dev.of_node with an unbalanced reference count. Do not put the borrowed platform device node from omap2430_probe(). References taken for the child MUSB device are handled by the device core, and the ctrl-module phandle reference is still released separately.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-23

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68371

EUVD

EUVD-2026-55472

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's musb omap2430 driver. The issue occurs in the probe function where a borrowed device node pointer is incorrectly released. The function stores the platform device's of_node in a local variable but does not take a reference to it. Later, the function calls of_node_put on this borrowed pointer, which reduces the reference count of the platform device's node. This can lead to an unbalanced reference count, potentially causing memory or resource management issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's musb omap2430 driver and does not have network-based detection methods. Check kernel logs for errors related to musb or omap2430 probe failures using: dmesg | grep musb or dmesg | grep omap2430.

Impact Analysis

This vulnerability may cause system instability or crashes due to improper handling of device node references. It could lead to memory leaks or resource exhaustion, affecting the reliability of systems using the musb omap2430 driver. Users might experience unexpected behavior or failures in USB functionality on affected Linux systems.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel issue related to reference counting in the USB subsystem. It may indirectly impact systems handling sensitive data if the kernel instability causes unexpected behavior, but no direct compliance impact is described.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. Monitor kernel logs for probe failures after updating. If using a custom kernel, ensure the musb omap2430 driver is patched to avoid calling of_node_put on borrowed references.

Hi! I’m here to help you understand CVE-2026-68371. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70