of: unittest: fix use-after-free in testdrv_probe()
At a glance
Severity
Not available
EPSS
EPSS 0.16 % · percentile 5 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved:
of: unittest: fix use-after-free in testdrv_probe()
The function testdrv_probe() retrieves the device_node from the PCI
device, applies an overlay, and then immediately calls of_node_put(dn).
This releases the reference held by the PCI core, potentially freeing
the node if the reference count drops to zero. Later, the same freed
pointer 'dn' is passed to of_platform_default_populate(), leading to a
use-after-free.
The reference to pdev->dev.of_node is owned by the device model and
should not be released by the driver. Remove the erroneous of_node_put()
to prevent premature freeing.
