Linux Kernel EUVD-2025-209681

The ti_fpc202 driver (drivers/misc/ti_fpc202.c) manages the Texas Instruments FPC202 USB Type-C port controller, a hardware component found in select embedded and industrial platforms. The vulnerability manifests in the driver's probe function, which enumerates child device tree nodes to configure hardware. Prior to the fix, the code used a standard iteration macro that did not automatically release the of_node reference upon early loop exit - a classic reference-counting bug in the Linux kernel device tree API (CWE-401). Each leaked reference retains kernel memory allocated for that node object, accumulating over repeated probe/unbind cycles. The fix replaces the iteration with for_each_child_of_node_scoped(), introduced in modern kernel releases to enforce automatic cleanup via scoped resource management. Affected CPE: cpe:2.3:a:linux:linux across all versions prior to the fix commits on kernel stable branches. The 'Information Disclosure' tag in the metadata appears inconsistent with the CVSS vector (C:N), which records no confidentiality impact - this likely reflects a tagging artifact rather than a confirmed data-leak scenario.