Executive brief
The Linux kernel's AS3722 voltage regulator driver contains a use-after-free vulnerability in its device tree configuration code. A premature reference release leaves a dangling pointer in the device structure, which could lead to memory corruption, system crashes, or privilege escalation on systems using AS3722 regulators.
Technical details
The vulnerability is a use-after-free in the as3722_get_regulator_dt_data() function. The of_get_child_by_name() call acquires a reference on a device tree node (np), which is then assigned to pdev->dev.of_node. However, the function immediately calls of_node_put(np), releasing the reference and leaving pdev->dev.of_node as a dangling pointer. Subsequent code accessing this pointer can trigger memory corruption. The fix removes the premature of_node_put(np) call to allow the device to hold the reference for its lifetime. This is a kernel-level memory safety issue requiring a code patch applied during kernel compilation.
Affected products
- Linux Linux kernel multiple stable versions from 2.6.11 through 6.18+
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched