CVE-2026-63906

Linux · Kernel

A use-after-free vulnerability exists in the Linux kernel omap2430 USB driver due to improper reference counting of device tree nodes during probe initialization.

Executive summary

A use-after-free flaw in the Linux kernel USB driver could allow an attacker to achieve system instability or arbitrary code execution.

Vulnerability

The vulnerability resides in the omap2430_probe function, where an incorrect call to of_node_put leads to a use-after-free condition. This flaw can be triggered by an unauthenticated attacker, potentially allowing for memory corruption or system crashes.

Business impact

The ability to trigger a use-after-free condition in the kernel poses a high risk to overall system integrity. Given the CVSS score of 8.4, successful exploitation could lead to full system compromise or persistent denial of service, impacting the reliability of hardware peripherals and connected services.

Remediation

Immediate Action: Update the Linux kernel to version 6.1.176, 6.6.143, 6.12.93, or 6.18.35.

Proactive Monitoring: Review kernel logs for memory-related anomalies or driver-specific faults that could indicate an exploitation attempt.

Compensating Controls: If patching is delayed, disable the affected USB driver module if it is not required for system operation to eliminate the attack vector.

Exploitation status

Public Exploit Available: Unknown

Analyst recommendation

This is a high-severity kernel vulnerability that requires immediate attention. System administrators should verify current kernel builds and deploy the provided fixes to mitigate the risk of memory corruption and potential code execution.