CVE-2026-23030: phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()
In the Linux kernel, the following vulnerability has been resolved:
phy: rockchip: inno-usb2: Fix a double free bug in rockchipusb2phyprobe()
The foreachavailablechildofnode() calls ofnodeput() to release childnp in each success loop. After breaking from the loop with the childnp has been released, the code will jump to the putchild label and will call the ofnodeput() again if the devmrequestthreadedirq() fails. These cause a double free bug.
Fix by returning directly to avoid the duplicate ofnodeput().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23030?
CVE-2026-23030 is classified as a medium severity vulnerability due to potential exploitation risks.
How do I fix CVE-2026-23030?
To fix CVE-2026-23030, update to the latest version of the Linux kernel that includes the patch.
What types of systems are affected by CVE-2026-23030?
CVE-2026-23030 affects systems running vulnerable versions of the Linux kernel, particularly those utilizing the rockchip USB 2.0 PHY.
What issues can CVE-2026-23030 cause?
CVE-2026-23030 may lead to a double free bug, potentially causing system instability or crashes.
When was CVE-2026-23030 discovered?
CVE-2026-23030 was reported as part of ongoing vulnerability tracking in the Linux kernel.