CVE-2026-68371

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68371", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.386Z", "datePublished": "2026-08-10T12:03:49.287Z", "dateUpdated": "2026-08-23T12:46:19.885Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:46:19.885Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: musb: omap2430: Do not put borrowed of_node in probe\n\nomap2430_probe() stores pdev->dev.of_node in a local np variable. This is\na borrowed pointer and the probe function does not take a reference to\nit.\n\nThe success and error paths nevertheless call of_node_put(np). This drops\na reference that is owned by the platform device, and can leave\npdev->dev.of_node with an unbalanced reference count.\n\nDo not put the borrowed platform device node from omap2430_probe().\nReferences taken for the child MUSB device are handled by the device core,\nand the ctrl-module phandle reference is still released separately."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - omap2430_probe() is reached only via the local driver model - boot-time platform bus match on the OMAP MUSB device-tree node, deferred-probe retries, sysfs bind/unbind of musb-omap2430, or module load/unload. There is no network, adjacent-network, or remote path, and leveraging the prematurely released kobject name/OF node requires local heap manipulation in the same kmalloc cache.\nAC:L - The stray of_node_put(np) is unconditional on both the success return and the err_put_musb error path, so every probe invocation drops a reference the driver never took. There is no race to win, no timing window, and no memory-layout precondition; the imbalance occurs deterministically on each probe and reproduces at will through bind/unbind cycles.\nPR:N - No credential, capability, or namespace check exists on the path - the platform bus binds the OMAP MUSB node and drops the reference during kernel boot, before any user session exists, so the underflowed device_node state arises with zero privileges. Deliberate re-triggering via sysfs unbind would need root, but that is not needed for the vulnerable condition to occur.\nUI:N - The musb-omap2430 platform driver binds automatically when the device-tree node is populated, and deferred-probe retries run unattended during boot; no administrator action, victim interaction, mount, or file open is required for the unbalanced of_node_put() to execute.\nS:U - The corrupted struct device_node, its embedded kobject, and the OF tree all belong to the kernel's own security authority, and the faulting code runs in that same kernel context. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The premature release drives kobject_cleanup(), which kfree_const()s kobj->name while the device_node stays reachable via pdev->dev.of_node, the OF tree, and phandle lookups, so later kobject_name()/sysfs/%pOF accesses read back reclaimed heap contents an attacker can spray. The bad of_node_put() splat with dump_stack() additionally leaks kernel pointers and a full stack trace.\nI:H - A device_node whose backing kobject has been released and whose slab-allocated name has been freed yields write primitives once the memory is reclaimed: the embedded fwnode_handle.ops table is dereferenced by fwnode_call_int_op(), kobj.ktype->release is invoked on the next put, and the parent/child/sibling and device-link list heads permit list-manipulation writes during OF tree operations.\nA:H - Reaching zero produces \"ERROR: of_node_release() detected bad of_node_put()\" with dump_stack(), and the next get/put triggers a refcount_t underflow; use-after-free WARN - an outright panic under panic_on_warn. __kobject_del() also tears down the node's /sys/firmware/devicetree entries and cascades puts onto the parent node, and dereferencing the released node oopses the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/musb/omap2430.c"], "versions": [{"version": "22b60658a90260e3fbd57824e3afe5682c6afcf5", "lessThan": "f0e68402d13cd9ffb289da50e65d4429d0002174", "status": "affected", "versionType": "git"}, {"version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec", "lessThan": "eed56f105a7f70cbcfceb4df6deb6870fc58214d", "status": "affected", "versionType": "git"}, {"version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec", "lessThan": "58d1c81c0b54a0b9aa6d6af077b09aa2f1bd2193", "status": "affected", "versionType": "git"}, {"version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec", "lessThan": "0950ac52426b0ab32d3b8cf4afe1711668b19cb8", "status": "affected", "versionType": "git"}, {"version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec", "lessThan": "6c525c851e5912b9753622d796f2bc55c4913b04", "status": "affected", "versionType": "git"}, {"version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec", "lessThan": "c947360ae63eee1c9eacc030dd6f5a53f717addf", "status": "affected", "versionType": "git"}, {"version": "fed43efc00ba6ac8c6b95828cd5acfa3d45eca4d", "status": "affected", "versionType": "git"}, {"version": "6.1.2", "lessThan": "6.1.184", "status": "affected", "versionType": "semver"}, {"version": "6.0.16", "lessThan": "6.1", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/musb/omap2430.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.2", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.16"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f0e68402d13cd9ffb289da50e65d4429d0002174"}, {"url": "https://git.kernel.org/stable/c/eed56f105a7f70cbcfceb4df6deb6870fc58214d"}, {"url": "https://git.kernel.org/stable/c/58d1c81c0b54a0b9aa6d6af077b09aa2f1bd2193"}, {"url": "https://git.kernel.org/stable/c/0950ac52426b0ab32d3b8cf4afe1711668b19cb8"}, {"url": "https://git.kernel.org/stable/c/6c525c851e5912b9753622d796f2bc55c4913b04"}, {"url": "https://git.kernel.org/stable/c/c947360ae63eee1c9eacc030dd6f5a53f717addf"}], "title": "usb: musb: omap2430: Do not put borrowed of_node in probe", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/musb/omap2430.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f0e68402d13cd9ffb289da50e65d4429d0002174", "status": "affected", "version": "22b60658a90260e3fbd57824e3afe5682c6afcf5", "versionType": "git"}, {"lessThan": "eed56f105a7f70cbcfceb4df6deb6870fc58214d", "status": "affected", "version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec", "versionType": "git"}, {"lessThan": "58d1c81c0b54a0b9aa6d6af077b09aa2f1bd2193", "status": "affected", "version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec", "versionType": "git"}, {"lessThan": "0950ac52426b0ab32d3b8cf4afe1711668b19cb8", "status": "affected", "version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec", "versionType": "git"}, {"lessThan": "6c525c851e5912b9753622d796f2bc55c4913b04", "status": "affected", "version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec", "versionType": "git"}, {"lessThan": "c947360ae63eee1c9eacc030dd6f5a53f717addf", "status": "affected", "version": "ffbe2feac59b37c8dc536727552b4f375e1b9aec", "versionType": "git"}, {"status": "affected", "version": "fed43efc00ba6ac8c6b95828cd5acfa3d45eca4d", "versionType": "git"}, {"lessThan": "6.1.184", "status": "affected", "version": "6.1.2", "versionType": "semver"}, {"lessThan": "6.1", "status": "affected", "version": "6.0.16", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/musb/omap2430.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: musb: omap2430: Do not put borrowed of_node in probe\n\nomap2430_probe() stores pdev->dev.of_node in a local np variable. This is\na borrowed pointer and the probe function does not take a reference to\nit.\n\nThe success and error paths nevertheless call of_node_put(np). This drops\na reference that is owned by the platform device, and can leave\npdev->dev.of_node with an unbalanced reference count.\n\nDo not put the borrowed platform device node from omap2430_probe().\nReferences taken for the child MUSB device are handled by the device core,\nand the ctrl-module phandle reference is still released separately."}], "id": "CVE-2026-68371", "lastModified": "2026-08-23T13:16:36.540", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-10T13:20:29.920", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0950ac52426b0ab32d3b8cf4afe1711668b19cb8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/58d1c81c0b54a0b9aa6d6af077b09aa2f1bd2193"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6c525c851e5912b9753622d796f2bc55c4913b04"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c947360ae63eee1c9eacc030dd6f5a53f717addf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eed56f105a7f70cbcfceb4df6deb6870fc58214d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f0e68402d13cd9ffb289da50e65d4429d0002174"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: USB MUSB OMAP2430 driver unbalanced reference count", "id": "2513274", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513274"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nusb: musb: omap2430: Do not put borrowed of_node in probe\nomap2430_probe() stores pdev->dev.of_node in a local np variable. This is\na borrowed pointer and the probe function does not take a reference to\nit.\nThe success and error paths nevertheless call of_node_put(np). This drops\na reference that is owned by the platform device, and can leave\npdev->dev.of_node with an unbalanced reference count.\nDo not put the borrowed platform device node from omap2430_probe().\nReferences taken for the child MUSB device are handled by the device core,\nand the ctrl-module phandle reference is still released separately.", "A flaw was found in the Linux kernel's USB MUSB OMAP2430 driver. The `omap2430_probe()` function incorrectly decrements the reference count of a borrowed device node, leading to an unbalanced reference count. This issue could potentially result in a denial of service."], "name": "CVE-2026-68371", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:03:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68371\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68371\nhttps://git.kernel.org/stable/c/0950ac52426b0ab32d3b8cf4afe1711668b19cb8\nhttps://git.kernel.org/stable/c/58d1c81c0b54a0b9aa6d6af077b09aa2f1bd2193\nhttps://git.kernel.org/stable/c/6c525c851e5912b9753622d796f2bc55c4913b04\nhttps://git.kernel.org/stable/c/c947360ae63eee1c9eacc030dd6f5a53f717addf\nhttps://git.kernel.org/stable/c/eed56f105a7f70cbcfceb4df6deb6870fc58214d"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffbe2feac59b37c8dc536727552b4f375e1b9aec,eed56f105a7f70cbcfceb4df6deb6870fc58214d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffbe2feac59b37c8dc536727552b4f375e1b9aec,58d1c81c0b54a0b9aa6d6af077b09aa2f1bd2193)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffbe2feac59b37c8dc536727552b4f375e1b9aec,0950ac52426b0ab32d3b8cf4afe1711668b19cb8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffbe2feac59b37c8dc536727552b4f375e1b9aec,6c525c851e5912b9753622d796f2bc55c4913b04)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ffbe2feac59b37c8dc536727552b4f375e1b9aec,c947360ae63eee1c9eacc030dd6f5a53f717addf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "fed43efc00ba6ac8c6b95828cd5acfa3d45eca4d"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "22b60658a90260e3fbd57824e3afe5682c6afcf5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.16,6.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.2,6.2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.151,6.7.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T15:45:03.651215+00:00", "updated": "2026-08-14T02:00:15.441445+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}