CVE-2026-64161 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
net: ti: icssm-prueth: fix eth_ports_node leak in probe
The error path on of_property_read_u32() failure inside icssm_prueth_probe() returns without putting eth_ports_node, which was acquired before the for_each_child_of_node() loop.
Drop it before returning.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within the Linux kernel's network subsystem specifically in the ti icssm-prueth driver implementation. The issue manifests as a memory leak occurring during device probe operations when the driver fails to properly release a reference to a device tree node. The flaw is particularly significant because it represents a classic resource management error that can lead to progressive memory consumption over time. When the driver encounters a failure in the of_property_read_u32() function call, it follows an error path that terminates without executing the necessary cleanup operation to release the eth_ports_node reference that was previously acquired.
The technical implementation flaw occurs within the icssm_prueth_probe() function where the driver processes device tree nodes using a for_each_child_of_node() loop structure. During normal execution flow, the driver acquires a reference to eth_ports_node through a call to of_get_child_by_name() or similar device tree traversal mechanism, but when the subsequent of_property_read_u32() operation fails, the function returns early without executing the corresponding of_node_put() call that would release this acquired reference. This behavior creates a dangling reference that prevents the kernel's device tree subsystem from properly reclaiming memory resources associated with the node. The vulnerability is classified as a resource leak under CWE-404 and represents a failure in proper resource management patterns.
The operational impact of this memory leak can be substantial in embedded systems or real-time applications where memory resources are constrained and predictable behavior is critical. As the driver is probed multiple times during system initialization or device hot-plugging scenarios, each failure condition results in an unreleased node reference that accumulates over time. This progressive resource consumption can lead to system instability, reduced performance, or even complete system hangs in memory-constrained environments. The vulnerability is particularly concerning in industrial automation and real-time control systems where the ti icssm-prueth driver interfaces with programmable real-time units in industrial communication networks.
The fix for this vulnerability involves implementing proper error handling that ensures resource cleanup occurs regardless of execution path. Specifically, the code must acquire the eth_ports_node reference before entering the for_each_child_of_node() loop and ensure that this reference is properly released via of_node_put() before any early return occurs from the error path. This remediation follows standard kernel development practices and aligns with ATT&CK technique T1484 which involves privilege escalation through resource exhaustion attacks. The fix ensures that all code paths through the driver probe function maintain proper reference counting semantics, preventing the accumulation of unreleased device tree node references. This type of vulnerability is commonly addressed through automated static analysis tools that can detect improper resource management patterns in kernel code and represents a fundamental security principle of least privilege in resource handling operations.
The resolution demonstrates proper defensive programming practices that are essential for maintaining kernel stability and security. By ensuring that all acquired resources are properly released, regardless of execution flow, the driver maintains predictable memory usage characteristics and prevents potential denial-of-service conditions. This fix exemplifies the importance of comprehensive error path testing in kernel development environments where resource management failures can have cascading effects throughout the entire system architecture. The solution adheres to established kernel coding standards and represents a straightforward but critical correction that prevents long-term memory degradation in systems utilizing the ti icssm-prueth driver for industrial networking applications.