FKIE_CVE-2026-93273

Vulnerability from fkie_nvd - Published: 2026-09-24 16:17 - Updated: 2026-09-24 16:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594: Fix device node reference leaks in multiphase loop In tps6594_regulator_probe(), the multi-phase configuration loop calls of_find_node_by_name() to find buck nodes by name, and of_get_parent() twice to navigate to the PMIC parent node. None of the acquired node references (np, intermediate parent, np_pmic_parent) are ever released via of_node_put(), causing a reference leak on every loop iteration. Additionally, of_find_node_by_name() can return NULL, but the result was immediately passed to of_node_full_name() and of_get_parent() without a NULL check, which could lead to a NULL pointer dereference. Fix this by: - Adding a NULL check for np after of_find_node_by_name() - Storing the intermediate parent node in a local variable np_parent - Calling of_node_put() on np, np_parent and np_pmic_parent at the end of each loop iteration
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/28f70e0aa767a8f022c70ed75ecef227dc668121
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4a672bff99f6b58dde419fd12b3a53da137f032d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/68ce4f8223b78f8616ec7f4a02c38988eae627d2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7fd28093b3effc4f92566466df364622830ec608
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/fceac25487b21d6db940d2aed368e465d89cd1f4
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/regulator/tps6594-regulator.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "28f70e0aa767a8f022c70ed75ecef227dc668121",
              "status": "affected",
              "version": "f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8",
              "versionType": "git"
            },
            {
              "lessThan": "4a672bff99f6b58dde419fd12b3a53da137f032d",
              "status": "affected",
              "version": "f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8",
              "versionType": "git"
            },
            {
              "lessThan": "68ce4f8223b78f8616ec7f4a02c38988eae627d2",
              "status": "affected",
              "version": "f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8",
              "versionType": "git"
            },
            {
              "lessThan": "fceac25487b21d6db940d2aed368e465d89cd1f4",
              "status": "affected",
              "version": "f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8",
              "versionType": "git"
            },
            {
              "lessThan": "7fd28093b3effc4f92566466df364622830ec608",
              "status": "affected",
              "version": "f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/regulator/tps6594-regulator.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: tps6594: Fix device node reference leaks in multiphase loop\n\nIn tps6594_regulator_probe(), the multi-phase configuration loop calls\nof_find_node_by_name() to find buck nodes by name, and of_get_parent()\ntwice to navigate to the PMIC parent node. None of the acquired node\nreferences (np, intermediate parent, np_pmic_parent) are ever released\nvia of_node_put(), causing a reference leak on every loop iteration.\n\nAdditionally, of_find_node_by_name() can return NULL, but the result was\nimmediately passed to of_node_full_name() and of_get_parent() without a\nNULL check, which could lead to a NULL pointer dereference.\n\nFix this by:\n- Adding a NULL check for np after of_find_node_by_name()\n- Storing the intermediate parent node in a local variable np_parent\n- Calling of_node_put() on np, np_parent and np_pmic_parent at the\n  end of each loop iteration"
    }
  ],
  "id": "CVE-2026-93273",
  "lastModified": "2026-09-24T16:17:24.400",
  "metrics": {},
  "published": "2026-09-24T16:17:24.400",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/28f70e0aa767a8f022c70ed75ecef227dc668121"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4a672bff99f6b58dde419fd12b3a53da137f032d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/68ce4f8223b78f8616ec7f4a02c38988eae627d2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7fd28093b3effc4f92566466df364622830ec608"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/fceac25487b21d6db940d2aed368e465d89cd1f4"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.