CVE-2026-98415: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node
In the Linux kernel, the following vulnerability has been resolved:
soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node
The setupcpuhpandcpuidle() parses the device tree node for the interrupt generation block via ofparsephandle() and decrements its reference count using ofnodeput() immediately after fetching the resource address. However, later the intrgennode pointer is passed into ofsysconregisterregmap().
Fix this by declaring intrgennode with free() and removing ofnodeput().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Declare intr_gen_node with __free() and remove the immediate of_node_put() call so its reference remains valid when passed to of_syscon_register_regmap().
Event History
Frequently Asked Questions
What condition leads to the invalid node use?
The interrupt generator device-tree node is parsed and its reference count is decremented immediately after its resource address is fetched. The same pointer is then later supplied to of_syscon_register_regmap().
Is a fixed kernel version specified?
No fixed version is provided. The supplied references identify stable-tree commits 4450102d6aa2a85b1d2d8610920fcbe45eb0ef69, 164313e24cb0f51528bc2099c5564174ead11d8a, and 4dd1999783d7d12434006289338373e49492dc96.