Linux Kernel CVE-2026-64301

The System Control and Management Interface (SCMI) is an ARM-specified firmware protocol used primarily on ARM-based server and embedded SoC platforms to abstract power management, clocking, and voltage regulation from the OS. The Linux kernel's regulator/scmi driver (drivers/regulator/scmi-regulator.c) calls of_find_node_by_name() during probe to locate device-tree nodes describing regulators; this function increments the reference count of the returned node. On the error path where process_scmi_regulator_of_node() returns failure, the code returns early without invoking of_node_put(np) to release that reference. Repeated probe failures - whether due to transient errors, deferred probe sequences, or misconfigured DT - accumulate unreleased references in the kernel's OF subsystem, consuming non-reclaimable memory. The CWE field is marked N/A, but the root cause class is CWE-401 (Missing Release of Memory after Effective Lifetime) or equivalently a resource management error in the OF reference-counting model.