CVE-2026-64301 - Vulnerability Details

- regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()

Description

In the Linux kernel, the following vulnerability has been resolved:

regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()

scmi_regulator_probe() calls of_find_node_by_name() which takes a
reference on the returned device node. On the error path where
process_scmi_regulator_of_node() fails, the function returns without
calling of_node_put() on the child node, leaking the reference.

Add of_node_put(np) on the error path to properly release the
reference.

Published: 2026-07-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The SCMI regulator driver in the Linux kernel leaks a device-node reference when the probe fails, due to the missing of_node_put on the error path. This reference-count leak is a classic resource-management flaw (CWE‑391) that can accumulate over time, exhausting kernel memory and causing a system‑wide denial of service.

Affected Systems

Any Linux kernel build that includes the SCMI regulator driver is susceptible; the CVE does not specify a version range, but the fix has been committed to the kernel source and referenced in the public patch set.

Risk and Exploitability

The EPSS score is below 1% and the issue is not listed in the CISA KEV catalog, indicating a very low likelihood of real‑world exploitation. An attacker would need privileged access to load or reload the driver or to force probe failures repeatedly. In the absence of such capabilities, the risk to typical deployments remains low, though a persistent privileged threat actor could trigger the leak enough times to degrade system stability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0fbeae70ee7ce98e18a47337cd1f205dd88589e9`	affected	< 1e446e8f8c763be3de7d0362e024cdf46194ffef
`0fbeae70ee7ce98e18a47337cd1f205dd88589e9`	affected	< 637c11e3d8d43a7ee654591cda8d17c55a9234fa
`0fbeae70ee7ce98e18a47337cd1f205dd88589e9`	affected	< e2baf8ea13fb4b10bec2c4751aea05c00dabcd0f
`0fbeae70ee7ce98e18a47337cd1f205dd88589e9`	affected	< 3e1441a4d06d35a314961e40057bd1f0106bbc14
`0fbeae70ee7ce98e18a47337cd1f205dd88589e9`	affected	< 22cb337370e6539b0418832c6040e9b00c1b74ca
`0fbeae70ee7ce98e18a47337cd1f205dd88589e9`	affected	< a935b64548fcfe1d5b4dbdd31dddfb0d7019367f
`0fbeae70ee7ce98e18a47337cd1f205dd88589e9`	affected	< fa11039d6cdff84584a3ef8cc1f5e1b56e045da2

Linux

affected

Version	Status	Constraints
`5.11`	affected	—
`0`	unaffected	< 5.11
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[0fbeae70ee7ce98e18a47337cd1f205dd88589e9,1e446e8f8c763be3de7d0362e024cdf46194ffef)`	affected	code_commit	—
`[0fbeae70ee7ce98e18a47337cd1f205dd88589e9,637c11e3d8d43a7ee654591cda8d17c55a9234fa)`	affected	code_commit	—
`[0fbeae70ee7ce98e18a47337cd1f205dd88589e9,e2baf8ea13fb4b10bec2c4751aea05c00dabcd0f)`	affected	code_commit	—
`[0fbeae70ee7ce98e18a47337cd1f205dd88589e9,3e1441a4d06d35a314961e40057bd1f0106bbc14)`	affected	code_commit	—
`[0fbeae70ee7ce98e18a47337cd1f205dd88589e9,22cb337370e6539b0418832c6040e9b00c1b74ca)`	affected	code_commit	—
`[0fbeae70ee7ce98e18a47337cd1f205dd88589e9,a935b64548fcfe1d5b4dbdd31dddfb0d7019367f)`	affected	code_commit	—
`[0fbeae70ee7ce98e18a47337cd1f205dd88589e9,fa11039d6cdff84584a3ef8cc1f5e1b56e045da2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.11`	affected	semver	—
`[0,5.11)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.4,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel version that includes the SCMI regulator patch that adds of_node_put on the error path.
If a kernel upgrade cannot be performed immediately, unload or disable the SCMI regulator driver unless the underlying hardware requires it.
If the kernel must remain unchanged, monitor kernel logs for repeated failures in process_scmi_regulator_of_node, which could indicate the reference leak is occurring.

Generated by OpenCVE AI on August 2, 2026 at 13:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00206.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1e446e8f8c763be3de7d0362e024cdf46194ffef
https://git.kernel.org/stable/c/22cb337370e6539b0418832c6040e9b00c1b74ca
https://git.kernel.org/stable/c/3e1441a4d06d35a314961e40057bd1f0106bbc14
https://git.kernel.org/stable/c/637c11e3d8d43a7ee654591cda8d17c55a9234fa
https://git.kernel.org/stable/c/a935b64548fcfe1d5b4dbdd31dddfb0d7019367f
https://git.kernel.org/stable/c/e2baf8ea13fb4b10bec2c4751aea05c00dabcd0f
https://git.kernel.org/stable/c/fa11039d6cdff84584a3ef8cc1f5e1b56e045da2
https://lore.kernel.org/linux-cve-announce/2026072506-CVE-2026-64301-65bc@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64301
https://www.cve.org/CVERecord?id=CVE-2026-64301

History

Sat, 01 Aug 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-391

Thu, 30 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072506-CVE-2026-64301-65bc@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64301 https://www.cve.org/CVERecord?id=CVE-2026-64301
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sun, 26 Jul 2026 02:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-391

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() scmi_regulator_probe() calls of_find_node_by_name() which takes a reference on the returned device node. On the error path where process_scmi_regulator_of_node() fails, the function returns without calling of_node_put() on the child node, leaking the reference. Add of_node_put(np) on the error path to properly release the reference.
Title		regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1e446e8f8c763be3de7d0362e024cdf46194ffef https://git.kernel.org/stable/c/22cb337370e6539b0418832c6040e9b00c1b74ca https://git.kernel.org/stable/c/3e1441a4d06d35a314961e40057bd1f0106bbc14 https://git.kernel.org/stable/c/637c11e3d8d43a7ee654591cda8d17c55a9234fa https://git.kernel.org/stable/c/a935b64548fcfe1d5b4dbdd31dddfb0d7019367f https://git.kernel.org/stable/c/e2baf8ea13fb4b10bec2c4751aea05c00dabcd0f https://git.kernel.org/stable/c/fa11039d6cdff84584a3ef8cc1f5e1b56e045da2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:49:36.999Z

Updated: 2026-07-25T08:49:36.999Z

Reserved: 2026-07-19T15:36:31.778Z

Link: CVE-2026-64301

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-07-25T10:17:11.043

Modified: 2026-08-11T15:00:57.447

Link: CVE-2026-64301

Redhat

Severity : Low

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64301 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-02T13:30:17Z

Weaknesses

No weakness.

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object