CVE-2026-89504 (GCVE-0-2026-89504)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-14 12:00
VLAI
Title
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
Summary
In the Linux kernel, the following vulnerability has been resolved: regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer In as3722_get_regulator_dt_data(), of_get_child_by_name() acquires a reference on np, which is then assigned to pdev->dev.of_node. The function immediately calls of_node_put(np), releasing the reference and leaving pdev->dev.of_node as a dangling pointer. Remove the of_node_put(np) call to let the device hold the reference.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bc407334e9a6a745de5360395282beb2690adf48 , < d9b1407477fb736978b04108073180ca84958936 (git)
Affected: bc407334e9a6a745de5360395282beb2690adf48 , < bd5606e9da1a01a61c7d2f5df36243414a0142be (git)
Affected: bc407334e9a6a745de5360395282beb2690adf48 , < 0bde4f140e90f87ebd49cd9c884c4bb3f19fe931 (git)
Affected: bc407334e9a6a745de5360395282beb2690adf48 , < eda08b6bd64f01ca9defbfcc9e0c3e30f46cfc02 (git)
Affected: bc407334e9a6a745de5360395282beb2690adf48 , < d3c1316d84e0a036890b00ae6e4c0b0b80f70c25 (git)
Affected: bc407334e9a6a745de5360395282beb2690adf48 , < 95342d26f9c6b68a46ab57fa48428a3c4a423dd7 (git)
Affected: bc407334e9a6a745de5360395282beb2690adf48 , < 8648e29e5c01b6b677c704049189287e27255ccb (git)
Affected: bc407334e9a6a745de5360395282beb2690adf48 , < f9324d670ae0b88cbfb0aa48fcaefa5baeb8da4c (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.13
Unaffected: 0 , < 3.13 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/regulator/as3722-regulator.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d9b1407477fb736978b04108073180ca84958936",
              "status": "affected",
              "version": "bc407334e9a6a745de5360395282beb2690adf48",
              "versionType": "git"
            },
            {
              "lessThan": "bd5606e9da1a01a61c7d2f5df36243414a0142be",
              "status": "affected",
              "version": "bc407334e9a6a745de5360395282beb2690adf48",
              "versionType": "git"
            },
            {
              "lessThan": "0bde4f140e90f87ebd49cd9c884c4bb3f19fe931",
              "status": "affected",
              "version": "bc407334e9a6a745de5360395282beb2690adf48",
              "versionType": "git"
            },
            {
              "lessThan": "eda08b6bd64f01ca9defbfcc9e0c3e30f46cfc02",
              "status": "affected",
              "version": "bc407334e9a6a745de5360395282beb2690adf48",
              "versionType": "git"
            },
            {
              "lessThan": "d3c1316d84e0a036890b00ae6e4c0b0b80f70c25",
              "status": "affected",
              "version": "bc407334e9a6a745de5360395282beb2690adf48",
              "versionType": "git"
            },
            {
              "lessThan": "95342d26f9c6b68a46ab57fa48428a3c4a423dd7",
              "status": "affected",
              "version": "bc407334e9a6a745de5360395282beb2690adf48",
              "versionType": "git"
            },
            {
              "lessThan": "8648e29e5c01b6b677c704049189287e27255ccb",
              "status": "affected",
              "version": "bc407334e9a6a745de5360395282beb2690adf48",
              "versionType": "git"
            },
            {
              "lessThan": "f9324d670ae0b88cbfb0aa48fcaefa5baeb8da4c",
              "status": "affected",
              "version": "bc407334e9a6a745de5360395282beb2690adf48",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/regulator/as3722-regulator.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer\n\nIn as3722_get_regulator_dt_data(), of_get_child_by_name() acquires a\nreference on np, which is then assigned to pdev-\u003edev.of_node. The\nfunction immediately calls of_node_put(np), releasing the reference and\nleaving pdev-\u003edev.of_node as a dangling pointer.\n\nRemove the of_node_put(np) call to let the device hold the reference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The dangling of_node is created only on the local as3722-regulator platform probe path (I2C MFD as3722_i2c_probe \u2192 mfd_add_devices \u2192 as3722_regulator_probe \u2192 as3722_get_regulator_dt_data); the onboard AMS AS3722 PMIC is not reached via network packets, Bluetooth, or USB enumeration.\nAC:L - On affected Tegra boards the required regulators DT child exists, so of_get_child_by_name() then the premature of_node_put() runs deterministically at every probe with no race; with OF_OVERLAY (arm64 defconfig) the node can be freed while the device still holds the pointer.\nPR:N - tegra_defconfig builds MFD_AS3722 and REGULATOR_AS3722 in, so the vulnerable probe runs automatically at boot on Chromebooks (nyan), Jetson TK1, Toradex Apalis, and similar embedded systems with no capability check; an attacker only needs to power-cycle a shared kiosk or device.\nUI:N - Driver initialization and the of_node_put() run unattended during kernel boot on affected hardware; no victim action such as mounting a filesystem, opening a device, or plugging in USB is required.\nS:U - The use-after-free corrupts kernel device_node/kobject memory on the host; AS3722 is a board PMIC regulator driver and does not cross a VM, IOMMU, or other security-authority boundary.\nC:H - The premature of_node_put() leaves pdev-\u003edev.of_node dangling; a later put on device release or DT overlay teardown can free the device_node while the driver and OF core still use it, enabling reads of reallocated slab memory.\nI:H - Use-after-free of the device_node heap object (kobject, fwnode, property and parent/child links) can be turned into an arbitrary write and control-flow hijack via heap reuse, matching scoring guidance that UAF is Integrity High.\nA:H - Dereferencing the dangling of_node during regulator registration, sysfs, overlay removal, or platform_device_release() can oops or panic the kernel, including at boot on systems where AS3722 supplies CPU and core rails."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:34.265Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d9b1407477fb736978b04108073180ca84958936"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd5606e9da1a01a61c7d2f5df36243414a0142be"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bde4f140e90f87ebd49cd9c884c4bb3f19fe931"
        },
        {
          "url": "https://git.kernel.org/stable/c/eda08b6bd64f01ca9defbfcc9e0c3e30f46cfc02"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3c1316d84e0a036890b00ae6e4c0b0b80f70c25"
        },
        {
          "url": "https://git.kernel.org/stable/c/95342d26f9c6b68a46ab57fa48428a3c4a423dd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/8648e29e5c01b6b677c704049189287e27255ccb"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9324d670ae0b88cbfb0aa48fcaefa5baeb8da4c"
        }
      ],
      "title": "regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89504",
    "datePublished": "2026-09-11T19:43:52.024Z",
    "dateReserved": "2026-09-11T19:38:34.715Z",
    "dateUpdated": "2026-09-14T12:00:34.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89504",
      "date": "2026-09-23",
      "epss": "0.00144",
      "percentile": "0.0402"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-15T01:47:02.000Z",
      "cve": "CVE-2026-89504",
      "id": "msrc_CVE-2026-89504",
      "initial_release_date": "2026-09-13T01:06:43.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89504.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/regulator/as3722-regulator.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d9b1407477fb736978b04108073180ca84958936",
                    "status": "affected",
                    "version": "bc407334e9a6a745de5360395282beb2690adf48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bd5606e9da1a01a61c7d2f5df36243414a0142be",
                    "status": "affected",
                    "version": "bc407334e9a6a745de5360395282beb2690adf48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0bde4f140e90f87ebd49cd9c884c4bb3f19fe931",
                    "status": "affected",
                    "version": "bc407334e9a6a745de5360395282beb2690adf48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eda08b6bd64f01ca9defbfcc9e0c3e30f46cfc02",
                    "status": "affected",
                    "version": "bc407334e9a6a745de5360395282beb2690adf48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d3c1316d84e0a036890b00ae6e4c0b0b80f70c25",
                    "status": "affected",
                    "version": "bc407334e9a6a745de5360395282beb2690adf48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "95342d26f9c6b68a46ab57fa48428a3c4a423dd7",
                    "status": "affected",
                    "version": "bc407334e9a6a745de5360395282beb2690adf48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8648e29e5c01b6b677c704049189287e27255ccb",
                    "status": "affected",
                    "version": "bc407334e9a6a745de5360395282beb2690adf48",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f9324d670ae0b88cbfb0aa48fcaefa5baeb8da4c",
                    "status": "affected",
                    "version": "bc407334e9a6a745de5360395282beb2690adf48",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/regulator/as3722-regulator.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.13"
                  },
                  {
                    "lessThan": "3.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.221",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer\n\nIn as3722_get_regulator_dt_data(), of_get_child_by_name() acquires a\nreference on np, which is then assigned to pdev-\u003edev.of_node. The\nfunction immediately calls of_node_put(np), releasing the reference and\nleaving pdev-\u003edev.of_node as a dangling pointer.\n\nRemove the of_node_put(np) call to let the device hold the reference."
          }
        ],
        "id": "CVE-2026-89504",
        "lastModified": "2026-09-14T13:19:07.210",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:32.673",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0bde4f140e90f87ebd49cd9c884c4bb3f19fe931"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8648e29e5c01b6b677c704049189287e27255ccb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/95342d26f9c6b68a46ab57fa48428a3c4a423dd7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bd5606e9da1a01a61c7d2f5df36243414a0142be"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d3c1316d84e0a036890b00ae6e4c0b0b80f70c25"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d9b1407477fb736978b04108073180ca84958936"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eda08b6bd64f01ca9defbfcc9e0c3e30f46cfc02"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f9324d670ae0b88cbfb0aa48fcaefa5baeb8da4c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-18T21:28:51+00:00",
      "cve": "CVE-2026-89504",
      "id": "CVE-2026-89504",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89504.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:02:44Z",
      "cve": "CVE-2026-89504",
      "id": "CVE-2026-89504",
      "initial_release_date": "2026-09-16T00:02:44Z",
      "product_status:known_affected": "265",
      "product_status:known_not_affected": "88",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89504",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89504.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.