CVE-2026-23030 in Linux
Summary
by MITRE • 01/31/2026
In the Linux kernel, the following vulnerability has been resolved:
phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()
The for_each_available_child_of_node() calls of_node_put() to release child_np in each success loop. After breaking from the loop with the child_np has been released, the code will jump to the put_child label and will call the of_node_put() again if the devm_request_threaded_irq() fails. These cause a double free bug.
Fix by returning directly to avoid the duplicate of_node_put().
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/02/2026
The vulnerability identified as CVE-2026-23030 represents a critical double free error within the Rockchip USB2 PHY driver of the Linux kernel. This flaw exists in the phy/rockchip/inno-usb2.c file where the rockchip_usb2phy_probe() function handles the initialization of USB phy devices for Rockchip SoCs. The issue arises from improper resource management during device tree node traversal and interrupt request handling, creating a scenario where the same memory resource gets freed twice, potentially leading to system instability or arbitrary code execution.
The technical implementation of this vulnerability stems from the misuse of the for_each_available_child_of_node() macro which automatically calls of_node_put() on each iteration to release the child node reference. When the loop encounters a successful condition and breaks out of the iteration, the child node reference remains in a released state. Subsequently, if the devm_request_threaded_irq() function fails, the code path jumps to a put_child label that attempts to call of_node_put() again on the already-released node reference. This duplicate deallocation creates a classic double free condition that violates memory safety principles and can be exploited by malicious actors to corrupt kernel memory structures.
This vulnerability directly maps to CWE-415, which describes double free conditions in software where the same memory location is freed twice. The operational impact of this flaw extends beyond simple memory corruption, as it can lead to kernel panics, system crashes, or potentially enable privilege escalation attacks. Attackers could exploit this weakness by manipulating the device tree configuration or triggering specific hardware initialization sequences that would cause the kernel to follow the problematic code path. The vulnerability affects systems using Rockchip SoCs with USB2 PHY controllers, particularly those running Linux kernel versions where this specific code path has not been patched.
The fix implemented addresses this issue by modifying the code flow to return directly from the function instead of jumping to the cleanup label that would trigger the duplicate of_node_put() call. This approach prevents the execution path from reaching the second of_node_put() invocation that would occur after the loop break. The solution follows established kernel development practices for resource management and adheres to the principle of avoiding redundant cleanup operations in error handling paths. This remediation aligns with the Linux kernel's security guidelines and represents a straightforward fix that eliminates the double free condition while maintaining the intended functionality of the USB PHY driver initialization process. Organizations should prioritize applying this patch to systems using Rockchip SoCs to prevent potential exploitation of this memory corruption vulnerability.