CVE-2026-23426

Vulnerability

In the Linux kernel's DRM driver for the LogiCVC display controller, the function logicvc_drm_config_parse() acquires a device node reference via of_get_child_by_name() to locate the "layers" child node, but it never releases that reference. This oversight creates a device node reference leak, meaning the kernel's reference count for the node is permanently incremented, preventing proper garbage collection and leading to memory resource waste.

Exploitation

The vulnerability is triggered automatically during driver initialization when logicvc_drm_config_parse() is invoked. No special privileges or authentication are required, as the leak occurs in normal kernel boot or module loading. An attacker who can force repeated bind/unbind cycles of the drm/logicvc driver, or load the module multiple times, could accelerate the leak. However, the leak is local and requires the system to be running a vulnerable kernel version.

Impact

While the CVSS v3 base score is 5.5 (Medium), the primary impact is availability. Repeated exploitation could gradually exhaust kernel memory (since device node structures are not freed), leading to system instability or denial of service. Data confidentiality and integrity are not directly affected.

Mitigation

The fix has been committed to the Linux kernel stable trees: commits [1], [2], [3], and [4] each apply the same correction to different stable branches. The resolution replaces the manual reference release with the __free(device_node) cleanup attribute, ensuring the reference is automatically dropped when the local variable goes out of scope. Users should update to a kernel containing the fix.