High · published September 23, 2025
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: fix potential OF node use-after-free
The for_each_child_of_node() helper drops the reference it takes to each
node as it iterates over children and an explicit of_node_put() is only
needed when exiting the loop early.
Drop the recently introduced bogus additional reference count decrement
at each iteration that could potentially lead to a use-after-free.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 6.6.105, < 6.6.107 | 6.6.107 |
| linux/linux_kernel | ≥ 6.12.45, < 6.12.48 | 6.12.48 |
| linux/linux_kernel | ≥ 6.16.5, < 6.16.8 | 6.16.8 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |