CVE-2026-23030: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23030 is a double free vulnerability in the Linux kernel's Rockchip inno-usb2 PHY driver, specifically within the rockchip_usb2phy_probe() function. It was published on January 31, 2026, and affects Linux kernel versions from 5.17 onward, with patches available in versions 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6 (Red Hat Bugzilla, Feedly). The CVE status is listed as "Deferred" by Red Hat, and the estimated CVSS severity is Medium with an EPSS score of 0.018% (Feedly).

The root cause is a double free condition (CWE-415) in the rockchip_usb2phy_probe() function of the phy/rockchip/inno-usb2 driver. The for_each_available_child_of_node() macro automatically calls of_node_put() to release the child_np reference on each successful loop iteration; however, if devm_request_threaded_irq() subsequently fails after the loop breaks, the error-handling code jumps to the put_child label and calls of_node_put() a second time on the already-released pointer (Red Hat Bugzilla). The fix avoids the duplicate release by returning directly from the error path rather than jumping to the cleanup label. Exploitation would require local access to a system with Rockchip USB2 PHY hardware and the ability to trigger the IRQ request failure code path.

Successful exploitation of this double free bug can result in kernel memory corruption, potentially leading to a kernel panic or system crash (denial of service) on affected Rockchip-based systems (Feedly). In more severe scenarios, memory corruption from a double free could theoretically be leveraged for privilege escalation, though no such exploitation has been demonstrated. The impact is limited to systems using Rockchip USB2 PHY hardware, which narrows the affected asset scope primarily to embedded and ARM-based devices running affected Linux kernel versions.

Patches are available in Linux kernel versions 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6 via upstream commits (Red Hat Bugzilla). Downstream distributions including SUSE (SUSE-SU-2026:1661-1), Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1), and Oracle Enterprise Linux have released updated kernel packages incorporating this fix (Feedly). Administrators should prioritize updating the kernel on systems using Rockchip USB2 PHY hardware; as a temporary measure, restricting local access to USB device initialization operations may reduce exposure.