CVE-2026-89504: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89504 Overview

CVE-2026-89504 is a Linux kernel vulnerability in the as3722 regulator driver. The flaw resides in the as3722_get_regulator_dt_data() function, where of_get_child_by_name() acquires a reference on a device tree node np and assigns it to pdev->dev.of_node. The function then immediately calls of_node_put(np), releasing the reference and leaving pdev->dev.of_node as a dangling pointer. Subsequent access to that pointer can trigger use-after-free conditions in kernel context.

Critical Impact
A local attacker capable of triggering the affected regulator code path may leverage the dangling of_node reference to compromise kernel memory integrity, confidentiality, and availability.

Affected Products

Linux kernel branches containing drivers/regulator/as3722-regulator.c with the pre-patch as3722_get_regulator_dt_data() implementation
Systems using the ams AS3722 PMIC (commonly Tegra-based platforms)
Distribution kernels that have not backported the fix commits referenced by the Linux stable tree

Discovery Timeline

2026-09-11 - CVE-2026-89504 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89504

Vulnerability Analysis

The defect is a reference-counting error in the AS3722 regulator initialization path. of_get_child_by_name() returns a device tree node with an incremented refcount. The driver stores that pointer in pdev->dev.of_node for later use by the device model, but then drops the only reference it holds via of_node_put(np). Once the last reference is released, the underlying device_node structure can be freed, while pdev->dev.of_node continues to point at the freed memory.

Any subsequent dereference of pdev->dev.of_node, whether by the regulator core, downstream consumers, or generic OF helpers, operates on a dangling pointer. This produces classic use-after-free behavior in kernel context and may corrupt adjacent slab objects.

Root Cause

The root cause is improper lifetime management of a reference-counted device tree node. The device is expected to hold the reference for the entire time pdev->dev.of_node remains assigned, but the driver releases it prematurely. The fix removes the of_node_put(np) call so the device retains the reference for the object's lifetime.

Attack Vector

Exploitation requires local access and the ability to reach the affected code path during driver probe or reinitialization on hardware exposing the AS3722 PMIC. An attacker who can influence allocator state around the freed device_node may shape memory to convert the use-after-free into privilege escalation or kernel information disclosure. No authentication or user interaction is required beyond local code execution.

No public proof-of-concept exploit is currently associated with this CVE. Refer to the upstream fix commits, including Linux kernel commit 0bde4f1 and commit d3c1316, for the exact code change.

Detection Methods for CVE-2026-89504

Indicators of Compromise

Unexpected kernel oops or panic messages referencing as3722, regulator, or of_get_child_by_name in dmesg and /var/log/kern.log
KASAN reports flagging use-after-free access on a device_node object allocated during regulator probe
Slab corruption warnings correlated with regulator subsystem activity on Tegra or other AS3722-equipped platforms

Detection Strategies

Enable CONFIG_KASAN and CONFIG_DEBUG_KOBJECT_RELEASE on test kernels to surface dangling of_node accesses during regression testing
Inventory running kernels against the fixed commit hashes published on git.kernel.org to confirm patch application
Monitor kernel ring buffer telemetry from endpoint agents for repeated crashes in the regulator or OF subsystem

Monitoring Recommendations

Forward kernel logs and crash reports to a centralized data lake for correlation across fleet devices
Alert on unexpected reboots or kernel panics on embedded and ARM systems that use the AS3722 PMIC
Track vendor and distribution security bulletins for backports referencing the AS3722 regulator fix

How to Mitigate CVE-2026-89504

Immediate Actions Required

Upgrade to a Linux kernel release that includes the upstream fix removing the premature of_node_put(np) call in as3722_get_regulator_dt_data()
Apply distribution-provided stable kernel updates on all affected hosts, prioritizing systems running on Tegra or other AS3722-equipped hardware
Validate that custom or vendor kernels rebased from older branches include the corresponding backport commit

Patch Information

The fix is available across multiple stable branches. Reference commits include 0bde4f1, 8648e29, 95342d2, bd5606e, d3c1316, d9b1407, eda08b6, and f9324d6. The patch removes the errant of_node_put(np) so the device holds the reference for the object's lifetime.

Workarounds

Restrict local access on systems that cannot be patched immediately, minimizing untrusted user code execution
Where the AS3722 PMIC is not required, disable or unbind the as3722-regulator driver via kernel configuration or unbind sysfs
Deploy KASAN-enabled test kernels in staging to detect exploitation attempts before rolling patches to production

bash

# Verify the running kernel does not include the vulnerable code path
uname -r
modinfo as3722-regulator | grep -E 'filename|version'
# Unbind the driver on hosts that do not require the AS3722 PMIC
echo -n "<device-id>" | sudo tee /sys/bus/platform/drivers/as3722-regulator/unbind