The musb omap2430 USB driver in the Linux kernel incorrectly releases a reference to the device tree node it borrowed during probe, causing an unbalanced reference count for pdev->dev.of_node. This resource‑management error (CWE‑911) can lead to a use‑after‑free or negative reference count if the node is accessed after the driver has released the reference, potentially resulting in kernel instability.

Linux kernel builds that include the musb omap2430 driver on any platform using an OMAP2430 family chip. The advisory does not list specific kernel versions or patch levels; any kernel that has not incorporated the patch that removes the offending of_node_put call is affected.

The CVSS score of 8.4 indicates high severity, and the EPSS score of less than 1% shows a low probability of exploitation. The likely attack vector is local interaction with the OMAP2430 USB hardware or with a module that loads the same driver, inferred from the fact that the flaw resides in a driver’s probe routine. If an attacker can trigger the unbalanced reference count, it could cause a denial of service by generating a kernel panic or other instability. The vulnerability is not listed in the CISA KEV catalog.