CVE-2026-23030: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23030 Overview

CVE-2026-23030 is a double free vulnerability in the Linux kernel's Rockchip Inno USB2 PHY driver. The flaw resides in the rockchip_usb2phy_probe() function within the phy/rockchip/inno-usb2 driver. The for_each_available_child_of_node() iterator calls of_node_put() on child_np during each successful loop iteration. When execution breaks from the loop after child_np is released and devm_request_threaded_irq() fails, control jumps to the put_child label, triggering a second of_node_put() call on an already-released node. The upstream fix returns directly from the failure path to avoid the duplicate reference decrement.

Critical Impact
A double free on a device tree node reference can corrupt kernel reference counting, leading to memory corruption or denial of service on affected Rockchip-based systems.

Affected Products

Linux kernel — Rockchip Inno USB2 PHY driver (drivers/phy/rockchip/phy-rockchip-inno-usb2.c)
Systems using Rockchip SoCs that rely on the inno-usb2 PHY driver
Stable kernel branches receiving the referenced backport commits

Discovery Timeline

2026-01-31 - CVE-2026-23030 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-23030

Vulnerability Analysis

The vulnerability is a double free [CWE-415] affecting device tree node reference counting in the Rockchip Inno USB2 PHY probe routine. The for_each_available_child_of_node() macro increments the child_np reference at each iteration and is responsible for decrementing it via of_node_put() before moving to the next child. When the loop exits early due to an error, the cleanup path at the put_child label calls of_node_put() again on the same child_np. This decrements the reference count twice for a single acquisition.

The condition is reached when devm_request_threaded_irq() fails inside the loop body after of_node_put() has already been invoked by the iterator's exit logic. The kernel's device tree subsystem treats this as a double release of an of_node, which can free the node prematurely while other code paths still reference it.

Root Cause

The defect stems from mismatched ownership semantics between the iterator macro and the manual cleanup label. Developers expected the put_child label to be the single release point, but for_each_available_child_of_node() performs an implicit of_node_put() on loop exit. The fix replaces the goto put_child with a direct return, eliminating the duplicate decrement.

Attack Vector

The code path executes during driver probe. Triggering the failure requires a state in which devm_request_threaded_irq() fails after at least one successful loop iteration. The vulnerability is local to the kernel and does not present a remote attack surface. The vulnerability has not been reported as exploited in the wild and is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified public exploit code is available. The mechanism is described in prose; refer to the upstream patches for the precise diff: Kernel Git Commit #efe92ee and Kernel Git Commit #ebae26d.

Detection Methods for CVE-2026-23030

Indicators of Compromise

Kernel oops or panic messages referencing of_node_put or rockchip_usb2phy_probe during boot or module load
refcount_t: underflow warnings emitted from the device tree subsystem
USB2 PHY initialization failures on Rockchip platforms followed by abnormal kernel states

Detection Strategies

Inventory running kernels and compare against the fixed commits listed in the upstream references
Use static analysis tools such as Coccinelle or Smatch to flag duplicate of_node_put() calls on the same iterator variable
Review dmesg output on Rockchip hardware for probe-time warnings tied to the inno-usb2 driver

Monitoring Recommendations

Forward kernel logs to a centralized analytics platform and alert on BUG, WARNING, or refcount strings
Track kernel package versions across the fleet and flag hosts running unpatched stable branches
Monitor device probe failures on embedded Rockchip systems as an operational health signal

How to Mitigate CVE-2026-23030

Immediate Actions Required

Update affected systems to a Linux kernel release that incorporates the upstream fix commits
Identify Rockchip-based devices in the environment and prioritize firmware and kernel updates for them
Rebuild and redeploy custom kernels for embedded products with the patched driver

Patch Information

The fix is applied across multiple stable branches. Reference the upstream commits: Kernel Git Commit #027d42b, Kernel Git Commit #b97b2c9, Kernel Git Commit #e07dea3, Kernel Git Commit #ebae26d, and Kernel Git Commit #efe92ee. The patch replaces the goto put_child with a direct return on the devm_request_threaded_irq() failure path.

Workarounds

Disable the phy-rockchip-inno-usb2 driver on systems that do not require USB2 PHY functionality
Avoid hardware or device tree configurations that increase the likelihood of IRQ registration failure during probe
Apply vendor-supplied kernel updates from Linux distribution maintainers as soon as they ship the backports

bash

# Verify the installed kernel and check for the patched driver source
uname -r
modinfo phy-rockchip-inno-usb2 | grep -E 'filename|version|srcversion'