CVE-2026-68371: usb: musb: omap2430: Do not put borrowed of_node in probe
In the Linux kernel, the following vulnerability has been resolved:
usb: musb: omap2430: Do not put borrowed ofnode in probe
omap2430probe() stores pdev->dev.ofnode in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it.
The success and error paths nevertheless call ofnodeput(np). This drops a reference that is owned by the platform device, and can leave pdev->dev.ofnode with an unbalanced reference count.
Do not put the borrowed platform device node from omap2430probe(). References taken for the child MUSB device are handled by the device core, and the ctrl-module phandle reference is still released separately.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68371?
CVE-2026-68371 has a risk rating of 10, indicating it is critical.
How do I fix CVE-2026-68371?
To fix CVE-2026-68371, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-68371?
CVE-2026-68371 affects devices running the Linux kernel with the musb driver, particularly those using the omap2430 platform.
What type of vulnerability is CVE-2026-68371?
CVE-2026-68371 is a memory management vulnerability related to the improper handling of borrowed pointers.
Can CVE-2026-68371 be exploited remotely?
Exploitation of CVE-2026-68371 requires local access to the system, making remote exploitation unlikely.