CVE-2026-64161 Overview
CVE-2026-64161 is a resource management defect in the Linux kernel networking driver for Texas Instruments Industrial Communication Subsystem (ICSSM) PRU Ethernet. The flaw resides in the icssm_prueth_probe() function within net/ti/icssm-prueth. When of_property_read_u32() fails inside the for_each_child_of_node() loop, the error path returns without releasing the eth_ports_node device tree reference acquired before the loop. This produces a device tree node reference leak during driver probe failures.
Critical Impact
The reference leak occurs during driver initialization on TI platforms using PRU-ICSSM Ethernet. Repeated probe failures can exhaust device tree node references and destabilize kernel resource tracking.
Affected Products
- Linux kernel builds including the icssm-prueth TI PRU Ethernet driver
- Systems running on Texas Instruments SoCs with PRU-ICSS Ethernet subsystems
- Stable kernel branches prior to the commits referenced in the fix
Discovery Timeline
- 2026-07-19 - CVE-2026-64161 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64161
Vulnerability Analysis
The defect is a device tree node reference leak in the icssm_prueth_probe() function of the TI PRU Ethernet driver. The probe routine calls of_get_child_by_name() or an equivalent lookup to obtain eth_ports_node, which increases the kobject reference count on that device tree node. The driver then iterates child nodes using for_each_child_of_node() and reads properties via of_property_read_u32().
If of_property_read_u32() returns an error inside the iteration, the function returns directly to the caller. The cleanup call of_node_put(eth_ports_node) is skipped on this path. The reference count on the device tree node is never decremented, resulting in a kernel memory leak tied to struct device_node.
The upstream fix adds the missing of_node_put() call before returning on the error path. Three stable branch backports carry the correction, tracked as commits 6635fa84403c, 994358adc098, and ca029dde6ad7.
Root Cause
The root cause is a missing of_node_put() call in a probe error path. The driver acquires a reference to eth_ports_node outside the child-iteration loop but does not release it when property parsing fails inside the loop. Device tree reference counting requires balanced of_node_get()/of_node_put() pairs across all exit paths.
Attack Vector
This vulnerability is not remotely reachable. It requires probe failures of the affected driver, which are governed by hardware presence and device tree contents rather than attacker input. Exploitation would require the ability to trigger repeated probe failures on a system using the icssm-prueth driver, typically by physical or root-level control over the platform. The practical impact is limited to resource exhaustion and long-running kernel stability degradation on TI embedded platforms.
No public exploit exists for CVE-2026-64161. The issue is classified as a kernel memory leak rather than a code-execution primitive.
Detection Methods for CVE-2026-64161
Indicators of Compromise
- Kernel log entries showing repeated icssm_prueth_probe failures with of_property_read_u32 errors
- Growing kmemleak reports referencing device_node allocations tied to the TI PRU Ethernet subsystem
- Elevated /proc/slabinfo counters for device tree node objects on affected TI platforms
Detection Strategies
- Enable CONFIG_DEBUG_KMEMLEAK on test kernels and review scans for unfreed of_get_child_by_name allocations attributed to icssm-prueth
- Correlate driver probe failure messages with device tree node reference counters exposed under /sys/kernel/debug/
- Compare running kernel commit hashes against 6635fa84403c, 994358adc098, and ca029dde6ad7 to confirm patch presence
Monitoring Recommendations
- Track kernel dmesg output for icssm-prueth probe errors across fleet TI platforms
- Alert on unexpected reboots or module reload cycles on devices using PRU-ICSS Ethernet
- Include kernel version and patch metadata in configuration management inventories
How to Mitigate CVE-2026-64161
Immediate Actions Required
- Update to a Linux kernel release that includes commits 6635fa84403c, 994358adc098, or ca029dde6ad7 on the applicable stable branch
- Inventory TI-based embedded devices and identify those loading the icssm-prueth module
- Restrict physical and administrative access to devices where kernel updates are not yet deployed
Patch Information
The fix adds the missing of_node_put(eth_ports_node) call on the of_property_read_u32() error path inside icssm_prueth_probe(). Refer to the upstream commits: Kernel Git Commit 6635fa84403c, Kernel Git Commit 994358adc098, and Kernel Git Commit ca029dde6ad7. Distribution kernels should pick up the patch through routine stable updates.
Workarounds
- Avoid unbinding and rebinding the icssm-prueth driver on unpatched kernels to limit probe-failure iterations
- Where the PRU Ethernet interface is not required, blacklist the icssm-prueth module to prevent probe execution
- Validate device tree contents to reduce of_property_read_u32() failures during boot on affected platforms
# Verify whether the running kernel contains the fix
uname -r
grep -R "icssm_prueth_probe" /proc/kallsyms 2>/dev/null
# Optionally prevent driver load on unpatched systems
echo "blacklist icssm-prueth" | sudo tee /etc/modprobe.d/icssm-prueth.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
