CVE-2026-43165: Linux Kernel Resource Leak Vulnerability

CVE-2026-43165 Overview

CVE-2026-43165 is a resource leak vulnerability in the Linux kernel's hwmon subsystem, specifically within the nct7363 driver. The flaw resides in the nct7363_present_pwm_fanin function, which calls of_parse_phandle_with_args() without releasing the returned device node reference via of_node_put(). Each invocation increments the reference count without a corresponding decrement, producing a memory leak over time. The Linux kernel maintainers have resolved the issue across multiple stable branches.

Critical Impact
Repeated invocation of the affected code path leaks device node references, contributing to kernel memory exhaustion and potential local denial of service on systems using the NCT7363 hardware monitor.

Affected Products

Linux kernel versions containing the nct7363 hwmon driver prior to the fix commits
Linux stable branches addressed by commits 4923bbf, c8cde3d, and fb99b58
Systems using NCT7363 hardware monitoring chips for PWM fan control

Discovery Timeline

2026-05-06 - CVE-2026-43165 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43165

Vulnerability Analysis

The nct7363 driver provides hardware monitoring support for the Nuvoton NCT7363 fan controller chip. During initialization, the driver iterates over device tree nodes to enumerate PWM and fan-in channels. The nct7363_present_pwm_fanin function uses of_parse_phandle_with_args() to resolve phandle references in the device tree.

The Linux device tree API requires callers of of_parse_phandle_with_args() to release the returned struct device_node reference using of_node_put(). The original implementation of nct7363_present_pwm_fanin omits this call. As a result, every successful parse operation increments the kobject reference count of the resolved node without ever decrementing it.

While the immediate effect is a small leak per probe, repeated module load and unload cycles, hot-plug events, or driver re-initialization on systems with multiple NCT7363 sensors compound the leak. Long-running systems may accumulate orphaned device node references, contributing to kernel memory pressure.

Root Cause

The root cause is missing reference counting hygiene in the nct7363_present_pwm_fanin function. Linux device tree helper APIs follow a get-and-release ownership model, and forgetting to call of_node_put() after of_parse_phandle_with_args() violates this contract. The patch series adds the missing of_node_put() call along the relevant code paths to balance the reference acquisition.

Attack Vector

The vulnerability requires local access to a system using the NCT7363 hwmon driver and the ability to trigger driver initialization paths. There is no remote attack vector. Exploitation as a security threat is limited because the leak rate is small and the affected code path is not directly reachable by unprivileged users. The primary impact is reliability and resource exhaustion on long-running embedded or server systems rather than privilege escalation or code execution.

The vulnerability is described in prose without exploit code because it is a kernel maintenance fix rather than a weaponizable flaw. See the upstream commit references for the exact code change.

Detection Methods for CVE-2026-43165

Indicators of Compromise

Gradual increase in unaccounted kernel slab memory usage on systems running the nct7363 driver
Kernel reference count warnings related to of_node objects in dmesg output
Unreleased device tree node references visible through kernel debug interfaces such as /sys/kernel/debug/kmemleak when enabled

Detection Strategies

Audit running kernel versions against the patched commit hashes 4923bbf, c8cde3d, and fb99b58 to confirm whether the fix is applied
Enable CONFIG_DEBUG_KMEMLEAK on test systems to identify reference count leaks originating from the hwmon subsystem
Monitor /proc/meminfo and slab statistics on systems with NCT7363 sensors for abnormal kernel memory growth over time

Monitoring Recommendations

Track Linux kernel package versions across the fleet using configuration management telemetry to identify hosts still running vulnerable builds
Collect kernel logs centrally and alert on WARNING messages from the of/ and hwmon/ subsystems
Establish baseline kernel memory consumption for systems with NCT7363 hardware and alert on sustained deviations

How to Mitigate CVE-2026-43165

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 4923bbf, c8cde3d, and fb99b58 from the stable kernel tree
Update to a Linux distribution kernel package that incorporates the fix for the nct7363_present_pwm_fanin resource leak
Inventory all systems using the NCT7363 hardware monitor and prioritize patching for long-running hosts where memory pressure is a concern

Patch Information

The Linux kernel maintainers have committed fixes across multiple stable branches. The relevant references are Kernel Git Commit 4923bbf, Kernel Git Commit c8cde3d, and Kernel Git Commit fb99b58. Each commit adds the missing of_node_put() call to release the device node reference returned by of_parse_phandle_with_args().

Workarounds

If patching is not immediately feasible, avoid repeated reload of the nct7363 kernel module to limit reference count accumulation
Schedule periodic reboots on systems where the driver is in active use to reset kernel reference counts
Disable the nct7363 driver on systems that do not require NCT7363 hardware monitoring functionality

bash

# Verify the running kernel includes the fix by checking commit hashes
uname -r
zcat /proc/config.gz | grep CONFIG_SENSORS_NCT7363

# Optionally blacklist the driver if NCT7363 monitoring is not required
echo "blacklist nct7363" | sudo tee /etc/modprobe.d/blacklist-nct7363.conf
sudo update-initramfs -u