Skip to main content

Linux Kernel EUVDEUVD-2026-55472

| CVE-2026-68371 HIGH
2026-08-10 Linux GHSA-prp8-g9xx-pr9j
Information Disclosure Linux
8.4
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

AC:H reflects mandatory OMAP2430 hardware presence; PR:L because triggering probe requires at least local user access or privileged module load; AV:L and full C/I/A impact retained for kernel memory corruption potential.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 03:00 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.4 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:03 cve.org
HIGH 8.4
CVE Published
Aug 10, 2026 - 12:03 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

usb: musb: omap2430: Do not put borrowed of_node in probe

omap2430_probe() stores pdev->dev.of_node in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it.

The success and error paths nevertheless call of_node_put(np). This drops a reference that is owned by the platform device, and can leave pdev->dev.of_node with an unbalanced reference count.

Do not put the borrowed platform device node from omap2430_probe(). References taken for the child MUSB device are handled by the device core, and the ctrl-module phandle reference is still released separately.

AnalysisAI

Reference count underflow in the Linux kernel's USB MUSB OMAP2430 driver exposes systems built on Texas Instruments OMAP2430 SoCs to potential use-after-free conditions in kernel memory, with theoretical impact spanning privilege escalation and system crash. The flaw in omap2430_probe() calls of_node_put() on a borrowed platform device OF node that was never reference-counted by the probe function, leaving pdev->dev.of_node with an unbalanced count that can trigger premature freeing. No public exploit exists and EPSS exploitation probability stands at 0.20% (10th percentile), consistent with the extremely narrow hardware attack surface; this vulnerability is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in drivers/usb/musb/omap2430.c, part of the Linux kernel's Multi-Role USB controller (MUSB) subsystem - specifically the integration layer for Texas Instruments OMAP2430 SoCs. Device tree (OF) nodes in the Linux driver model are reference-counted objects: callers must invoke of_node_get() before storing a pointer and of_node_put() when releasing it. omap2430_probe() borrows pdev->dev.of_node into a local variable np without calling of_node_get(), meaning no new reference is taken. Both the success and error return paths then call of_node_put(np), decrementing the reference count that is legitimately owned by the platform device core. If this drives the count to zero, the of_node struct is freed while the platform device still holds a live pointer to it. Any subsequent kernel subsystem dereference of pdev->dev.of_node constitutes a use-after-free. Affected CPE: cpe:2.3:a:linux:linux. No CWE is formally assigned, but this maps to CWE-911 (Improper Update of Reference Count) and proximately to CWE-416 (Use After Free).

RemediationAI

Apply the vendor-released kernel patch by upgrading to a fixed stable release: Linux 6.6.151, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 or later, selecting the branch that matches the deployed kernel. Individual fix commits are available at https://git.kernel.org/stable/c/eed56f105a7f70cbcfceb4df6deb6870fc58214d, https://git.kernel.org/stable/c/58d1c81c0b54a0b9aa6d6af077b09aa2f1bd2193, https://git.kernel.org/stable/c/0950ac52426b0ab32d3b8cf4afe1711668b19cb8, https://git.kernel.org/stable/c/6c525c851e5912b9753622d796f2bc55c4913b04, and https://git.kernel.org/stable/c/c947360ae63eee1c9eacc030dd6f5a53f717addf. For OMAP2430-based systems where an immediate kernel upgrade is not feasible, adding 'blacklist musb_omap2430' to /etc/modprobe.d/ prevents the vulnerable probe function from executing; the trade-off is complete loss of USB host and gadget functionality on the affected hardware. This workaround is irrelevant for all non-OMAP2430 Linux deployments, which are unaffected by this flaw.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55472 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy