CVE-2026-43264

Vulnerability

Overview

A refcount leak vulnerability exists in the Linux kernel's fbdev subsystem, specifically within the of_get_display_timings() function. The function uses of_parse_phandle() to obtain a device node pointer, which increments the reference count of the returned node. This pointer is stored in entry and later copied to native_mode. However, in error paths at lines 184 and 192, when jumping to the entryfail label, the reference count of native_mode is not decremented, leading to a leak [1].

Exploitation and

Attack Surface

Exploitation requires the ability to trigger the error paths in of_get_display_timings(), which is typically reached during boot or device tree parsing. No authentication is needed as it occurs in kernel initialization, but local access to trigger a particular device tree configuration or a crafted boot scenario may be necessary. The attack surface is limited to systems that utilize device tree-based display timing configuration.

Impact

An attacker who can repeatedly trigger the error paths can cause a gradual depletion of memory by leaking device_node references. While not directly leading to code execution, this could result in denial of service due to memory exhaustion, impacting system stability and availability.

Mitigation

The fix is included in Linux kernel stable updates. The patch changes the error path goto target from entryfail to timingfail, which properly calls of_node_put(native_mode) before cleanup, preventing the refcount leak [1][2]. Users should apply the updated kernel version to resolve the issue.