CVE-2026-23030

Vulnerability

Analysis

In the Linux kernel's Rockchip USB2 PHY driver, the rockchip_usb2phy_probe() function contains a double free bug in error handling. The loop for_each_available_child_of_node() automatically calls of_node_put() on child nodes each iteration. When breaking from the loop after a successful iteration, if devm_request_threaded_irq() fails, the code jumps to the put_child label and calls of_node_put() again on a child node that has already been released, causing a double free.

Exploitation

An attacker must have the ability to cause the devm_request_threaded_irq() call to fail during probe, typically by manipulating system resources (e.g., exhausting IRQ lines). This requires local access to the system where the affected Rockchip USB2 PHY hardware is present. No authentication is needed beyond being able to trigger the probe of the device.

Impact

A double free can lead to kernel memory corruption, resulting in a system crash (denial of service) or potentially enabling privilege escalation or arbitrary code execution if an attacker can control freed memory structures. The severity depends on the kernel's memory allocator protections.

Mitigation

The vulnerability is fixed in the Linux stable kernel by returning directly from the error path instead of jumping to the put_child label, eliminating the duplicate of_node_put() call. Patches are available as commit [1] and [2]. Users should apply the latest stable kernel updates to resolve this issue.