CVE-2026-43264: Linux Kernel Refcount Leak Vulnerability

CVE-2026-43264 Overview

CVE-2026-43264 is a refcount leak vulnerability in the Linux kernel's framebuffer device (fbdev) of_get_display_timings() function. The flaw resides in drivers/video/fbdev/core/fb_of.c (display_timing parsing). The function of_parse_phandle() returns a device_node with its reference count incremented. The reference is stored in entry and copied to native_mode. When error paths jump to the entryfail label, the reference held by native_mode is not released, producing a memory leak in kernel device tree node tracking.

Critical Impact
Repeated triggering of the error path leaks kernel device_node references, which can degrade system stability and lead to resource exhaustion over time.

Affected Products

Linux kernel (multiple stable branches receiving the backported fix)
Subsystem: fbdev (framebuffer device) display timing parser
Source file: drivers/video/fbdev/core/fb_of.c and related of_display_timing code path

Discovery Timeline

2026-05-06 - CVE-2026-43264 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43264

Vulnerability Analysis

The vulnerability is a kernel reference-counting bug categorized as a Memory Leak. The function of_get_display_timings() parses display timing data from a Device Tree (DT) node. It calls of_parse_phandle() to obtain a handle to a native-mode child node, which increments the underlying device_node refcount.

The returned pointer is assigned to a local variable entry and then propagated to native_mode. Subsequent error checks at lines 184 and 192 detect malformed timing entries and transfer control via goto entryfail. The entryfail cleanup block does not call of_node_put(native_mode), so the incremented reference is never released.

Each failed parse leaks one device_node reference. Over many invocations, the leaked references prevent the affected DT node from being freed and consume kernel memory.

Root Cause

The root cause is incorrect goto-target selection in error-handling logic. The fix re-targets the failing branches from entryfail to timingfail, which already invokes of_node_put(native_mode) before performing the remaining cleanup. The correction ensures balanced refcount accounting for every exit path.

Attack Vector

Local triggering requires loading a malformed Device Tree containing a display-timings node with an invalid native-mode entry. On embedded systems and platforms that parse DT overlays at runtime, repeatedly applying a crafted overlay can amplify the leak. The bug is not a memory-safety vulnerability and does not allow arbitrary code execution or privilege escalation. Severity is bounded to resource leakage.

The vulnerability is a logic error in error-path cleanup. No exploitation code is published, and no proof-of-concept is required to characterize the defect. Refer to the upstream commits in the references for the exact patch hunks.

Detection Methods for CVE-2026-43264

Indicators of Compromise

Increasing kernel memory usage attributable to of_node allocations on systems that repeatedly parse display timing data.
dmesg warnings from the OF (Open Firmware) subsystem related to unreleased device-tree node references during module unload or DT overlay removal.
Failure to free framebuffer-related Device Tree nodes after error returns from of_get_display_timings().

Detection Strategies

Audit running kernel versions against the fixed commit hashes (20881ad4, 2b22e4fe, 3ed01965, 69290f2d, b5bdcc5a, c5734f90, d6f34bbf, eacf9840) listed in the Linux stable tree.
Use kmemleak (echo scan > /sys/kernel/debug/kmemleak) on test kernels with malformed DT overlays to confirm leaked allocations originate from of_get_display_timings().
Track kernel package versions through configuration management to identify hosts running unpatched fbdev code.

Monitoring Recommendations

Monitor /proc/meminfoSlab and SUnreclaim growth on long-running embedded devices that repeatedly load DT overlays.
Alert on kernel version drift across fleets where some hosts remain on pre-patch stable branches.
Collect dmesg and audit logs centrally to correlate display-driver initialization failures with kernel build identifiers.

How to Mitigate CVE-2026-43264

Immediate Actions Required

Apply the upstream Linux stable kernel update that includes the of_get_display_timings() refcount fix.
For distribution kernels, install the vendor-provided package update referencing CVE-2026-43264.
On embedded and IoT fleets, schedule firmware rebuilds that incorporate the patched kernel before redeployment.

Patch Information

The fix changes the goto target from entryfail to timingfail so of_node_put(native_mode) is invoked on the error path. Patches are merged across multiple stable branches. See the upstream commits referenced in the Linux kernel stable tree and the additional backports listed in the NVD references.

Workarounds

Avoid loading or accepting untrusted Device Tree overlays that define display-timings nodes on systems running unpatched kernels.
Where fbdev support is not required, build kernels without CONFIG_FB_OF to remove the affected code path entirely.
Restrict access to interfaces (/sys/kernel/config/device-tree/overlays/) that allow runtime DT overlay application to privileged administrators only.

bash

# Verify whether the running kernel includes one of the fixed commits
uname -r
zgrep -i 'of_get_display_timings' /proc/kallsyms 2>/dev/null

# Disable runtime device-tree overlay configfs interface where unused
umount /sys/kernel/config 2>/dev/null

# Optional: rebuild kernel without fbdev OF helper
# In kernel .config:
# CONFIG_FB_OF=n