CVE-2026-64301 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
scmi_regulator_probe() calls of_find_node_by_name() which takes a reference on the returned device node. On the error path where process_scmi_regulator_of_node() fails, the function returns without calling of_node_put() on the child node, leaking the reference.
Add of_node_put(np) on the error path to properly release the reference.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability resides in the Linux kernel's SCMI (System Control and Management Interface) regulator subsystem where a reference count leak occurs during device node handling within the scmi_regulator_probe() function. This represents a classic resource management flaw that can lead to system instability and potential denial of service conditions. The issue specifically affects systems utilizing SCMI-based power management controllers where device tree nodes are dynamically discovered and managed through the Open Firmware interface.
The technical flaw manifests when scmi_regulator_probe() invokes of_find_node_by_name() which inherently increments the reference count of the returned device node structure. However, during error handling scenarios where process_scmi_regulator_of_node() fails to properly initialize or configure the regulator, the function exits without invoking of_node_put() on the acquired node reference. This creates a dangling reference that prevents the kernel's device tree subsystem from properly releasing memory resources associated with the node structure.
From an operational perspective this vulnerability poses significant risks to embedded systems and server platforms that rely heavily on SCMI power management protocols. The reference count leak accumulates over time as multiple regulator probe operations fail, eventually leading to memory exhaustion within the device tree subsystem. Attackers could potentially exploit this by repeatedly triggering probe failures or by targeting systems with numerous SCMI regulators, causing progressive resource degradation that may result in system crashes or unresponsive states.
The vulnerability aligns with CWE-404, which categorizes improper resource management as a weakness where allocated resources are not properly released. Additionally, it relates to ATT&CK technique T1499.004, which covers network denial of service through resource exhaustion attacks. The memory leak pattern also corresponds to the broader class of kernel memory management issues that can compromise system stability and availability.
The fix implements a straightforward but critical defensive measure by adding explicit of_node_put(np) calls on all error paths within the scmi_regulator_probe() function. This ensures that every device node reference acquired through of_find_node_by_name() is properly released regardless of whether initialization succeeds or fails. The solution follows standard kernel development practices for reference counting and resource management, maintaining the existing code flow while eliminating the leak scenario.
The mitigation approach adheres to established kernel security guidelines and best practices for device tree node handling in kernel space. It represents a minimal, surgical fix that directly addresses the root cause without introducing additional complexity or performance overhead. The implementation ensures proper cleanup semantics across all execution paths and maintains backward compatibility with existing SCMI regulator functionality while preventing resource exhaustion conditions that could impact system reliability.
This vulnerability demonstrates the critical importance of proper reference counting in kernel space programming where resource leaks can accumulate silently and cause significant operational impacts. The fix exemplifies defensive programming principles that should be applied throughout kernel subsystems when dealing with device tree node references and other managed resources, reinforcing the need for comprehensive error path testing and resource management validation in security-critical code areas.