Executive brief
The Linux kernel's DRM graphics driver for RockChip includes a reference management leak in the analogix DisplayPort encoder initialization code. Device node references obtained via of_get_child_by_name() were not properly released, which can prevent kernel memory from being freed and potentially degrade system stability over time if the affected code path is exercised.
Technical details
This is a reference counting bug in the DRM RockChip analogix_dp driver (drivers/gpu/drm/rockchip/analogix_dp-rockchip.c). The function rockchip_dp_drm_encoder_enable() called of_get_child_by_name() and of_graph_get_remote_port() to obtain device tree nodes, but failed to symmetrically call of_node_put() for all acquired references before exiting the function. This causes memory leaks and prevents proper garbage collection of device tree structures. The fix uses the __free(device_node) attribute (auto-cleanup feature in Linux 6.4+) to automatically release device node references when variables go out of scope, replacing manual of_node_put() calls. The vulnerability affects only RockChip DRM code paths and requires the encoder enable function to be called to trigger the leak.
Affected products
- Linux Linux Kernel Various (fixed by commit 87e060521371257ddbb77964b66e60d80afcc7b2)
Timeline
- 2026-09-17: disclosed
- 2026-06-01: patched