Linux Kernel EUVD-2026-27661

The vulnerability resides in drivers/video/fbdev/of/display_timing.c within the of_get_display_timings() function of the Linux kernel's framebuffer device (fbdev) subsystem. The Open Firmware (OF) / device-tree subsystem uses of_parse_phandle() to resolve device-tree phandle references at runtime, returning a struct device_node pointer with its internal reference counter incremented by one. In the affected code, the returned pointer is stored in 'entry' and then copied into 'native_mode'. Two error paths at lines 184 and 192 incorrectly jump to the 'entryfail' label, which does not call of_node_put(native_mode) to release the incremented refcount, resulting in a classic reference count leak. This falls into the CWE-401 / CWE-772 resource management failure class. The fix is surgical: changing the goto destination from 'entryfail' to 'timingfail', which already contains the proper of_node_put(native_mode) cleanup call. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. The vulnerability was introduced with commit cc3f414cf2e404130584b63d373161ba6fd24bc2 in Linux 3.9 and persisted undetected across more than a decade of stable releases.