SB20260812162 - Operation on a Resource after Expiration or Release in Linux kernel usb musb driver

Description

This security bulletin contains information about 1 vulnerability.

1) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-68371)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper reference count handling in the omap2430_probe() function when probing the omap2430 USB MUSB platform device. A local user can trigger the driver probe to cause a denial of service.

The issue can leave pdev->dev.of_node with an unbalanced reference count because a borrowed device tree node pointer is released incorrectly.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0950ac52426b0ab32d3b8cf4afe1711668b19cb8
• https://git.kernel.org/stable/c/58d1c81c0b54a0b9aa6d6af077b09aa2f1bd2193
• https://git.kernel.org/stable/c/6c525c851e5912b9753622d796f2bc55c4913b04
• https://git.kernel.org/stable/c/c947360ae63eee1c9eacc030dd6f5a53f717addf
• https://git.kernel.org/stable/c/eed56f105a7f70cbcfceb4df6deb6870fc58214d