CVE-2026-64301: Linux Kernel Privilege Escalation Flaw

CVE-2026-64301 Overview

CVE-2026-64301 is a memory leak vulnerability in the Linux kernel's System Control and Management Interface (SCMI) regulator driver. The flaw resides in the scmi_regulator_probe() function within the regulator subsystem. The function calls of_find_node_by_name(), which acquires a reference on the returned device node. On the error path where process_scmi_regulator_of_node() fails, the function returns without calling of_node_put(), leaking the device node reference.

Critical Impact
Repeated probe failures can exhaust kernel device tree node references, contributing to resource exhaustion on affected systems.

Affected Products

Linux kernel with SCMI regulator driver enabled
Systems using ARM System Control and Management Interface for power regulation
Multiple stable kernel branches referenced in upstream commits

Discovery Timeline

2026-07-25 - CVE-2026-64301 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64301

Vulnerability Analysis

The vulnerability is a device tree node reference count leak [CWE-401] in the SCMI regulator probe path. The Linux kernel uses reference counting on device tree (of_node) structures to track active users. Functions like of_find_node_by_name() increment the reference count on returned nodes, and callers must release the reference with of_node_put() when finished.

In scmi_regulator_probe(), iteration over child device tree nodes obtains a reference for each node. When process_scmi_regulator_of_node() returns an error, the function exits the loop and returns immediately without releasing the reference on the current child node. This causes the reference counter to remain elevated beyond the expected lifetime.

Root Cause

The root cause is missing cleanup on an error return path. The probe function does not invoke of_node_put(np) before returning when child node processing fails, violating the kernel's reference counting contract for device tree nodes.

Attack Vector

This is a local, low-privilege issue triggered during driver probe. An attacker cannot directly exploit the leak remotely. Repeated probe failures, whether caused by malformed device tree data or module reload cycles, incrementally accumulate leaked references. The condition can degrade system stability over time on platforms that rely on the SCMI regulator driver.

The upstream fix adds an of_node_put(np) call on the error path before returning. See the kernel commit reference for the corrective patch.

Detection Methods for CVE-2026-64301

Indicators of Compromise

Growing device tree node reference counts observed via /sys/kernel/debug/device_tree/ inspection
Repeated scmi_regulator_probe failure messages in kernel logs (dmesg)
Kernel memory usage increases correlated with SCMI regulator module reloads

Detection Strategies

Inspect kernel version against patched stable trees listed in the upstream commit references
Monitor dmesg for SCMI regulator probe errors accompanied by driver initialization failures
Audit systems using ARM SCMI power management for kernel builds preceding the fix commits

Monitoring Recommendations

Track kernel memory metrics on ARM platforms leveraging SCMI regulators for baseline deviations
Alert on repeated driver probe failures in system logs to detect conditions that amplify the leak
Include kernel patch level verification in host configuration compliance scans

How to Mitigate CVE-2026-64301

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable git commits for your kernel branch
Rebuild and deploy kernels including the of_node_put() fix in scmi_regulator_probe()
Verify distribution vendors have backported the fix to supported long-term support kernels

Patch Information

The fix adds of_node_put(np) on the error path in scmi_regulator_probe() to release the child device tree node reference obtained from of_find_node_by_name(). Multiple stable branch commits have been published, including 1e446e8f8c76, 22cb337370e6, 3e1441a4d06d, 637c11e3d8d4, a935b64548fc, e2baf8ea13fb, and fa11039d6cdf. Consult the Linux kernel stable tree for branch-specific patches.

Workarounds

Disable the SCMI regulator driver (CONFIG_REGULATOR_ARM_SCMI) if not required by the platform
Avoid triggering repeated module reloads or probe cycles on unpatched systems
Restrict access to interfaces that can trigger driver reprobing to privileged users only

bash

# Verify kernel version and SCMI regulator configuration
uname -r
grep CONFIG_REGULATOR_ARM_SCMI /boot/config-$(uname -r)

# Check for probe-related messages
dmesg | grep -i scmi