UBUNTU-CVE-2026-93273: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594: Fix device node reference leaks in multiphase loop In tps6594regulatorprobe(), the multi-phase configuration loop calls offindnodebyname() to find buck nodes by name, and ofgetparent() twice to navigate to the PMIC parent node. None of the acquired node references (np, intermediate parent, nppmicparent) are ever released via ofnodeput(), causing a reference leak on every loop iteration. Additionally, offindnodebyname() can return NULL, but the result was immediately passed to ofnodefullname() and ofgetparent() without a NULL check, which could lead to a NULL pointer dereference. Fix this by: - Adding a NULL check for np after offindnodebyname() - Storing the intermediate parent node in a local variable npparent - Calling ofnodeput() on np, npparent and nppmicparent at the end of each loop iteration
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In tps6594_regulator_probe()'s multi-phase configuration loop, add a NULL check for np after of_find_node_by_name(); store the intermediate parent node in a local variable np_parent; and call of_node_put() on np, np_parent, and np_pmic_parent at the end of each loop iteration.
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
The issue affects the listed Ubuntu kernel packages when the TPS6594 regulator driver processes a multiphase device-tree configuration. Systems without that driver or configuration are not indicated as affected by the provided data.
What conditions are required to trigger the NULL pointer dereference?
The multiphase configuration loop must run and of_find_node_by_name() must fail to find the expected buck node. The vulnerable code then uses the NULL result without checking it before calling node-related functions.
What is the impact besides a possible NULL pointer dereference?
Each affected loop iteration leaks references to the buck node and its parent nodes. The fix releases the references at the end of every iteration.
How can I tell whether the relevant fix is present?
Check whether the installed Ubuntu kernel package includes the upstream stable commit 68ce4f8223b78f8616ec7f4a02c38988eae627d2. The provided data does not include fixed package version numbers.