CVE-2026-23314

Vulnerability

In the Linux kernel's bq257xx regulator driver, the function bq257xx_reg_dt_parse_gpio() fails to release a device node reference obtained via of_node_get() when a subchild lookup fails. This results in a reference count leak for the device node, as described in the CVE description [1].

Exploitation

The vulnerability is triggered during device tree parsing when the driver attempts to retrieve a GPIO subchild. If the subchild is not found, the function returns an error without calling of_node_put(child), leaving the reference dangling. An attacker would need local access to the system and the ability to trigger device tree parsing, typically through driver probe of the affected hardware or by loading/unloading the driver. No special privileges beyond local user access are required if the driver can be triggered from userspace.

Impact

Repeatedly triggering this code path can cause the kernel's device node reference count to leak, eventually leading to memory exhaustion or denial of service. The CVSS v3 score of 5.5 (Medium) reflects the local attack vector and potential for system instability.

Mitigation

The fix is included in the Linux kernel stable releases as commits [1], [2], and [3]. Users should update to a kernel version containing these patches with these commits. No workaround is available; the driver must be fixed to properly release the reference.