CVE-2026-68371 (GCVE-0-2026-68371)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:03 – Updated: 2026-08-17 05:04
VLAI
Title
usb: musb: omap2430: Do not put borrowed of_node in probe
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Do not put borrowed of_node in probe omap2430_probe() stores pdev->dev.of_node in a local np variable. This is a borrowed pointer and the probe function does not take a reference to it. The success and error paths nevertheless call of_node_put(np). This drops a reference that is owned by the platform device, and can leave pdev->dev.of_node with an unbalanced reference count. Do not put the borrowed platform device node from omap2430_probe(). References taken for the child MUSB device are handled by the device core, and the ctrl-module phandle reference is still released separately.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ffbe2feac59b37c8dc536727552b4f375e1b9aec , < eed56f105a7f70cbcfceb4df6deb6870fc58214d (git)
Affected: ffbe2feac59b37c8dc536727552b4f375e1b9aec , < 58d1c81c0b54a0b9aa6d6af077b09aa2f1bd2193 (git)
Affected: ffbe2feac59b37c8dc536727552b4f375e1b9aec , < 0950ac52426b0ab32d3b8cf4afe1711668b19cb8 (git)
Affected: ffbe2feac59b37c8dc536727552b4f375e1b9aec , < 6c525c851e5912b9753622d796f2bc55c4913b04 (git)
Affected: ffbe2feac59b37c8dc536727552b4f375e1b9aec , < c947360ae63eee1c9eacc030dd6f5a53f717addf (git)
Affected: fed43efc00ba6ac8c6b95828cd5acfa3d45eca4d (git)
Affected: 22b60658a90260e3fbd57824e3afe5682c6afcf5 (git)
Affected: 6.0.16 , < 6.1 (semver)
Affected: 6.1.2 , < 6.2 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/musb/omap2430.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eed56f105a7f70cbcfceb4df6deb6870fc58214d",
              "status": "affected",
              "version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec",
              "versionType": "git"
            },
            {
              "lessThan": "58d1c81c0b54a0b9aa6d6af077b09aa2f1bd2193",
              "status": "affected",
              "version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec",
              "versionType": "git"
            },
            {
              "lessThan": "0950ac52426b0ab32d3b8cf4afe1711668b19cb8",
              "status": "affected",
              "version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec",
              "versionType": "git"
            },
            {
              "lessThan": "6c525c851e5912b9753622d796f2bc55c4913b04",
              "status": "affected",
              "version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec",
              "versionType": "git"
            },
            {
              "lessThan": "c947360ae63eee1c9eacc030dd6f5a53f717addf",
              "status": "affected",
              "version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fed43efc00ba6ac8c6b95828cd5acfa3d45eca4d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "22b60658a90260e3fbd57824e3afe5682c6afcf5",
              "versionType": "git"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/musb/omap2430.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: musb: omap2430: Do not put borrowed of_node in probe\n\nomap2430_probe() stores pdev-\u003edev.of_node in a local np variable. This is\na borrowed pointer and the probe function does not take a reference to\nit.\n\nThe success and error paths nevertheless call of_node_put(np). This drops\na reference that is owned by the platform device, and can leave\npdev-\u003edev.of_node with an unbalanced reference count.\n\nDo not put the borrowed platform device node from omap2430_probe().\nReferences taken for the child MUSB device are handled by the device core,\nand the ctrl-module phandle reference is still released separately."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - omap2430_probe() is reached only via the local driver model - boot-time platform bus match on the OMAP MUSB device-tree node, deferred-probe retries, sysfs bind/unbind of musb-omap2430, or module load/unload. There is no network, adjacent-network, or remote path, and leveraging the prematurely released kobject name/OF node requires local heap manipulation in the same kmalloc cache.\nAC:L - The stray of_node_put(np) is unconditional on both the success return and the err_put_musb error path, so every probe invocation drops a reference the driver never took. There is no race to win, no timing window, and no memory-layout precondition; the imbalance occurs deterministically on each probe and reproduces at will through bind/unbind cycles.\nPR:N - No credential, capability, or namespace check exists on the path - the platform bus binds the OMAP MUSB node and drops the reference during kernel boot, before any user session exists, so the underflowed device_node state arises with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not needed for the vulnerable condition to occur.\nUI:N - The musb-omap2430 platform driver binds automatically when the device-tree node is populated, and deferred-probe retries run unattended during boot; no administrator action, victim interaction, mount, or file open is required for the unbalanced of_node_put() to execute.\nS:U - The corrupted struct device_node, its embedded kobject, and the OF tree all belong to the kernel\u0027s own security authority, and the faulting code runs in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The premature release drives kobject_cleanup(), which kfree_const()s kobj-\u003ename while the device_node stays reachable via pdev-\u003edev.of_node, the OF tree, and phandle lookups, so later kobject_name()/sysfs/%pOF accesses read back reclaimed heap contents an attacker can spray. The bad of_node_put() splat with dump_stack() additionally leaks kernel pointers and a full stack trace.\nI:H - A device_node whose backing kobject has been released and whose slab-allocated name has been freed yields write primitives once the memory is reclaimed: the embedded fwnode_handle.ops table is dereferenced by fwnode_call_int_op(), kobj.ktype-\u003erelease is invoked on the next put, and the parent/child/sibling and device-link list heads permit list-manipulation writes during OF tree operations.\nA:H - Reaching zero produces \"ERROR: of_node_release() detected bad of_node_put()\" with dump_stack(), and the next get/put triggers a refcount_t underflow; use-after-free WARN - an outright panic under panic_on_warn. __kobject_del() also tears down the node\u0027s /sys/firmware/devicetree entries and cascades puts onto the parent node, and dereferencing the released node oopses the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:04:16.465Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eed56f105a7f70cbcfceb4df6deb6870fc58214d"
        },
        {
          "url": "https://git.kernel.org/stable/c/58d1c81c0b54a0b9aa6d6af077b09aa2f1bd2193"
        },
        {
          "url": "https://git.kernel.org/stable/c/0950ac52426b0ab32d3b8cf4afe1711668b19cb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c525c851e5912b9753622d796f2bc55c4913b04"
        },
        {
          "url": "https://git.kernel.org/stable/c/c947360ae63eee1c9eacc030dd6f5a53f717addf"
        }
      ],
      "title": "usb: musb: omap2430: Do not put borrowed of_node in probe",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68371",
    "datePublished": "2026-08-10T12:03:49.287Z",
    "dateReserved": "2026-07-30T09:28:09.386Z",
    "dateUpdated": "2026-08-17T05:04:16.465Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68371",
      "date": "2026-08-20",
      "epss": "0.00182",
      "percentile": "0.08144"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68371\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:29.920\",\"lastModified\":\"2026-08-17T06:17:45.430\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: musb: omap2430: Do not put borrowed of_node in probe\\n\\nomap2430_probe() stores pdev-\u003edev.of_node in a local np variable. This is\\na borrowed pointer and the probe function does not take a reference to\\nit.\\n\\nThe success and error paths nevertheless call of_node_put(np). This drops\\na reference that is owned by the platform device, and can leave\\npdev-\u003edev.of_node with an unbalanced reference count.\\n\\nDo not put the borrowed platform device node from omap2430_probe().\\nReferences taken for the child MUSB device are handled by the device core,\\nand the ctrl-module phandle reference is still released separately.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/musb/omap2430.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ffbe2feac59b37c8dc536727552b4f375e1b9aec\",\"lessThan\":\"eed56f105a7f70cbcfceb4df6deb6870fc58214d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ffbe2feac59b37c8dc536727552b4f375e1b9aec\",\"lessThan\":\"58d1c81c0b54a0b9aa6d6af077b09aa2f1bd2193\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ffbe2feac59b37c8dc536727552b4f375e1b9aec\",\"lessThan\":\"0950ac52426b0ab32d3b8cf4afe1711668b19cb8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ffbe2feac59b37c8dc536727552b4f375e1b9aec\",\"lessThan\":\"6c525c851e5912b9753622d796f2bc55c4913b04\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ffbe2feac59b37c8dc536727552b4f375e1b9aec\",\"lessThan\":\"c947360ae63eee1c9eacc030dd6f5a53f717addf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fed43efc00ba6ac8c6b95828cd5acfa3d45eca4d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"22b60658a90260e3fbd57824e3afe5682c6afcf5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.0.16\",\"lessThan\":\"6.1\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.2\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/usb/musb/omap2430.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0950ac52426b0ab32d3b8cf4afe1711668b19cb8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/58d1c81c0b54a0b9aa6d6af077b09aa2f1bd2193\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6c525c851e5912b9753622d796f2bc55c4913b04\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c947360ae63eee1c9eacc030dd6f5a53f717addf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eed56f105a7f70cbcfceb4df6deb6870fc58214d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-13T23:28:35+00:00",
      "cve": "CVE-2026-68371",
      "id": "CVE-2026-68371",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: musb: omap2430: Do not put borrowed of_node in probe",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68371.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-14T23:44:37Z",
      "cve": "CVE-2026-68371",
      "id": "CVE-2026-68371",
      "initial_release_date": "2026-08-14T17:13:46Z",
      "product_status:known_affected": "129",
      "product_status:known_not_affected": "167",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68371",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68371.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.