CVE-2026-68371

CVE-2026-68371 stems from a reference counting error in the omap2430 USB driver probe function, and it exposes a trap that catches even competent kernel developers. The bug: omap2430_probe() calls of_node_put() on the device tree node passed to it by the platform device subsystem. That of_node is a borrowed reference—the caller owns it, not the probe function. Calling of_node_put() on a borrowed reference undercounts the reference, leaving a dangling pointer in pdev->dev.of_node that can cause use-after-free or memory leaks downstream. The fix is two lines: remove the of_node_put() calls. But the knowledge required to avoid this bug isn't obvious from API signatures, compiler warnings, or documentation. The kernel's device tree API provides no type-level distinction between borrowed and owned references. The of_node_put() kerneldoc describes the semantics, but the distinction between probe function parameters (borrowed) and locally-obtained references (owned) requires tribal knowledge that developers accumulate through experience—or through bugs like this one. This pattern isn't isolated. The same reference-counting-on-borrowed-pointers bug has appeared in platform device probes, regulator drivers, and PCI subsystem probe functions across kernel history. Each occurrence generates a patch and a CVE, but the knowledge doesn't transfer to the next developer working in a different subsystem. The kernel's architecture makes this structurally reproducible: every probe function is a potential trap, and the lack of ownership-annotated types or compiler enforcement means the trap depends entirely on individual developer awareness. For defenders: audit your probe functions for of_node_put() calls on the device node parameter. If you're adding reference-taking code to legacy drivers, verify whether the of_node came from the probe parameter (borrowed) or from a separate of_find_* call (owned). Consider whether your subsystem has active maintainers—if the driver sits in abandoned code paths, this class of vulnerability may have accumulated undetected. The patch is trivial; the systemic gap is not.

Reviewed through automated stages and approved by a human before publication.