Executive brief
A vulnerability in the Linux kernel's display controller driver could allow a local user to cause a system resource leak. Specifically, the driver for LogiCVC display hardware fails to properly release memory references when parsing configuration data. Over time, this could lead to system instability or a denial-of-service condition as available resources are exhausted.
Technical details
A reference leak exists in the logicvc_drm_config_parse() function within the drivers/gpu/drm/logicvc/logicvc_drm.c file. The function calls of_get_child_by_name() to locate the 'layers' node but fails to invoke a corresponding release function, resulting in a device node reference leak. An attacker with local access could potentially exploit this to exhaust kernel memory or references, leading to a denial-of-service (DoS). The issue has been resolved by implementing the __free(device_node) cleanup attribute to ensure automatic reference release when the variable goes out of scope.
Affected products
- Linux Linux Kernel 6.0 to 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7
Timeline
- 2026-01-30: patched: Initial patch authored by Felix Gu
- 2026-04-03: advisory: CVE-2026-23426 published by NVD
References
- https://git.kernel.org/stable/c/0bd326dffd9e103335d77d9c31275c0d5a7979eb
- https://git.kernel.org/stable/c/78e91e49d28e05ccaa6b445bafb5e367d57c9583
- https://git.kernel.org/stable/c/871630255ecd2d9b64ad1d75a7dfc0567d7d9989
- https://git.kernel.org/stable/c/b88f49910be147b7974098b9172b0d3873142d6a
- https://git.kernel.org/stable/c/f8a6eba20edb938166b26e133cc61306e1bc6de9
- https://git.kernel.org/stable/c/fef0e649f8b42bdffe4a916dd46e1b1e9ad2f207