CVE-2026-23030: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23030 Overview

CVE-2026-23030 is a Double Free vulnerability in the Linux kernel's Rockchip USB2 PHY driver (inno-usb2). The vulnerability exists in the rockchip_usb2phy_probe() function where improper memory management leads to a double free condition when the for_each_available_child_of_node() macro is used in conjunction with error handling paths.

The for_each_available_child_of_node() macro calls of_node_put() to release child_np in each successful loop iteration. When breaking from the loop after the child node has already been released, the code jumps to the put_child label which calls of_node_put() again if devm_request_threaded_irq() fails, resulting in a double free condition.

Critical Impact

This double free vulnerability in the Linux kernel's USB PHY driver could potentially be exploited to cause memory corruption, system instability, or denial of service on systems using Rockchip SoCs with the inno-usb2 driver.

Affected Products

• Linux kernel with Rockchip inno-usb2 PHY driver enabled
• Systems using Rockchip SoCs with USB2 PHY functionality
• Embedded devices and SBCs running affected kernel versions

Discovery Timeline

• 2026-01-31 - CVE CVE-2026-23030 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-23030

Vulnerability Analysis

This vulnerability represents a classic double free bug pattern that occurs during device probing in the Linux kernel's PHY subsystem. The issue stems from improper reference counting management of device tree nodes within the Rockchip USB2 PHY driver.

The for_each_available_child_of_node() macro is a common pattern in Linux kernel drivers for iterating over device tree child nodes. This macro internally manages reference counts by calling of_node_put() on the previous node before moving to the next iteration. The problem arises when an error occurs during iteration that causes a premature break from the loop.

When the devm_request_threaded_irq() function fails, the driver's error handling path jumps to the put_child label. At this point, the child node reference may have already been decremented by the macro, causing a subsequent explicit of_node_put() call to decrement the reference count below zero—a double free condition.

Double free vulnerabilities in kernel code are particularly dangerous as they can corrupt kernel memory allocator metadata, potentially leading to use-after-free conditions, kernel panics, or exploitable memory corruption scenarios.

Root Cause

The root cause is improper coordination between the automatic reference counting performed by the for_each_available_child_of_node() macro and the manual error handling cleanup code in rockchip_usb2phy_probe(). The error handling path at the put_child label unconditionally calls of_node_put() without accounting for whether the reference was already released by the iteration macro.

The fix addresses this by returning directly from the error path instead of jumping to the cleanup label, thus avoiding the duplicate of_node_put() call.

Attack Vector

The attack vector for this vulnerability is local in nature, as it requires interaction with the USB PHY driver during device probing. Exploitation would typically require:

1. A system running the affected Linux kernel with the Rockchip inno-usb2 driver
2. The ability to trigger device probing scenarios that cause devm_request_threaded_irq() to fail
3. Timing conditions that lead to the double free occurring in a exploitable manner

While exploitation complexity may be high due to the specific conditions required, double free vulnerabilities in kernel code should be treated seriously as they can potentially be leveraged for privilege escalation or denial of service.

Detection Methods for CVE-2026-23030

Indicators of Compromise

• Kernel panic or oops messages referencing the rockchip_usb2phy_probe function
• Memory corruption errors in kernel logs related to the USB PHY subsystem
• Unexpected system crashes during USB device enumeration on Rockchip platforms
• KASAN (Kernel Address Sanitizer) reports indicating double free in of_node_put()

Detection Strategies

• Enable KASAN (Kernel Address Sanitizer) to detect double free conditions at runtime
• Monitor kernel logs for memory allocation errors or warnings from the PHY subsystem
• Deploy kernel tracing (ftrace) on of_node_put() calls to identify abnormal reference counting
• Use SentinelOne Singularity to monitor for kernel-level memory corruption indicators

Monitoring Recommendations

• Configure syslog monitoring for kernel oops and panic messages
• Enable CONFIG_DEBUG_KOBJECT_RELEASE in debug kernels to catch reference counting issues
• Monitor for unexpected USB subsystem failures on affected Rockchip platforms
• Implement automated alerting for kernel crash dump collection and analysis

How to Mitigate CVE-2026-23030

Immediate Actions Required

• Update to a patched Linux kernel version containing the fix
• Review and audit other device tree iteration code for similar patterns
• Enable kernel debugging options on development systems to catch similar issues
• Apply vendor-supplied patches for Rockchip platform BSPs if available

Patch Information

The vulnerability has been resolved through multiple kernel commits. The fix modifies the error handling path to return directly instead of jumping to the cleanup label, preventing the duplicate of_node_put() call.

Official patches are available through the kernel stable tree:

• Kernel Commit Update
• Kernel Commit Change
• Kernel Commit Modification
• Kernel Commit Fix

Workarounds

• If patching is not immediately possible, consider disabling the inno-usb2 PHY driver if USB functionality is not required
• Use kernel live patching (kpatch/livepatch) to apply the fix without rebooting if available for your distribution
• Implement additional monitoring for kernel memory corruption on affected systems
• Restrict local access to the system to reduce the attack surface for exploitation

# Check if the vulnerable driver is loaded
lsmod | grep phy_rockchip_inno_usb2

# View kernel version to verify if patched
uname -r

# Check kernel config for driver status
zcat /proc/config.gz | grep CONFIG_PHY_ROCKCHIP_INNO_USB2