Linux EUVD-2026-18650

The logicvc_drm_config_parse() function in the Linux kernel's Direct Rendering Manager (DRM) subsystem calls of_get_child_by_name() to locate the 'layers' device tree node. The of_get_child_by_name() function increments the reference count of the returned device_node structure; callers must explicitly decrement this reference via of_node_put() or similar cleanup mechanism. The vulnerable code path neglected to release this reference, allowing the reference count to accumulate. The fix applies the __free(device_node) cleanup attribute (a GCC extension available in recent kernels), which automatically calls the appropriate cleanup function when the variable exits scope, eliminating manual reference management errors. This is a classic reference counting vulnerability in kernel device tree parsing code.