HIGH Introduced in 3.13
regulator as3722 DanglingPointer
CVE-2026-89504
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer In as3722_get_regulator_dt_data(), of_get_child_by_name() acquires a reference on np, which is then assigned to pdev->dev.of_node. The function immediately calls of_node_put(np), releasing the reference and leaving pdev->dev.of_node as a dangling pointer. Remove the of_node_put(np) call to let the device hold the reference.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability exists in the AS3722 regulator driver where a device tree node reference is prematurely released, leaving a dangling pointer that the device continues to use. This can lead to kernel instability or crashes when the regulator subsystem later accesses the stale pointer.
Vulnerability analysis
The AS3722 regulator driver acquires a reference to a device tree node and assigns it to the device structure, but immediately releases that reference, leaving the device holding a dangling pointer to potentially freed memory. When the regulator subsystem later accesses this pointer, it may dereference stale or recycled memory, causing a kernel crash or unpredictable behavior. The fix removes the premature reference release so the device properly retains ownership for its lifetime. This vulnerability is reachable during device probing on systems with the AS3722 PMIC, which is typically configured via device tree on embedded platforms; it requires no special privileges beyond the ability to trigger device probing.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.13 | 5.10.270 | d9b1407477fb |
| 5.15 | 3.13 | 5.15.221 | bd5606e9da1a |
| 6.1 | 3.13 | 6.1.188 | 0bde4f140e90 |
| 6.12 | 3.13 | 6.12.109 | d3c1316d84e0 |
| 6.18 | 3.13 | 6.18.50 | 95342d26f9c6 |
| 6.6 | 3.13 | 6.6.157 | eda08b6bd64f |
| 7.2 | 3.13 | 7.2.4 | 8648e29e5c01 |
| mainline | 3.13 | 7.3 | f9324d670ae0 |
| cip/5.10 | 3.13 | 5.10.271-cip78 | d9b1407477fb |
| cip/6.1 | 3.13 | 6.1.189-cip61 | 0bde4f140e90 |
| cip/6.1-rt | 3.13 | 6.1.189-cip61-rt32 | 0bde4f140e90 |
| cip/6.12 | 3.13 | 6.12.111-cip32 | d3c1316d84e0 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.271-cip78 |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |