Executive brief
A vulnerability was identified in the Linux kernel's Rockchip USB driver, which manages how the operating system communicates with specific USB hardware. A technical error in how the system handles memory during hardware initialization could lead to a system crash or instability. This issue primarily affects devices using Rockchip processors and requires local access to the system to be triggered.
Technical details
A double free vulnerability exists in the rockchip_usb2phy_probe() function in drivers/phy/rockchip/phy-rockchip-inno-usb2.c. The for_each_available_child_of_node() macro automatically handles reference counting by calling of_node_put() on each iteration. However, if devm_request_threaded_irq() fails, the code incorrectly jumps to a error-handling label that calls of_node_put() again on an already released node. This double free can be triggered during driver probing, potentially leading to a kernel panic. The issue has been resolved by changing the error path to return directly, avoiding the redundant call.
Affected products
- Linux Linux Kernel 6.1, 6.6, 6.12, 6.13
Timeline
- 2026-01-09: disclosed: Initial patch submitted by Wentao Liang
- 2026-01-31: advisory: CVE-2026-23030 published by the Linux kernel project
References
- https://git.kernel.org/stable/c/027d42b97e6eb827c3438ebc09bab7efaee9270d
- https://git.kernel.org/stable/c/b97b2c9808c9a97e0ce30216fa12096d8b0eaa75
- https://git.kernel.org/stable/c/e07dea3de508cd6950c937cec42de7603190e1ca
- https://git.kernel.org/stable/c/ebae26dd15140b840cf65be5e1c0daee949ba70b
- https://git.kernel.org/stable/c/efe92ee7a111fe0f4d75f3ed6b7e3f86322279d5
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html