CVE-2026-23426: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23426 is a device node reference leak vulnerability in the Linux kernel's drm/logicvc DRM driver. The logicvc_drm_config_parse() function calls of_get_child_by_name() to locate the "layers" device tree node but fails to release the acquired reference, resulting in an improper update of the reference count (CWE-911). It affects Linux kernel versions from 6.0 through multiple stable branches, with fixed versions including 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc2. Disclosed on April 3, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-911 (Improper Update of Reference Count). In logicvc_drm_config_parse(), the kernel function of_get_child_by_name() increments the reference count of the returned device node, but the code path never calls of_node_put() to decrement it, causing a reference leak. The fix applies the __free(device_node) cleanup attribute to the variable, ensuring the reference is automatically released when the variable goes out of scope. Exploitation requires local access with low privileges (attack vector: local, privileges required: low) and no user interaction (Red Hat CVE, GitHub Advisory).

The primary impact is availability: repeated invocations of the affected function without proper reference cleanup accumulate unreleased device node references, leading to memory exhaustion and resource depletion over time. This can result in denial of service conditions, system instability, or degraded performance on systems using the logicvc DRM driver. There is no confidentiality or integrity impact associated with this vulnerability (Red Hat CVE, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term (Red Hat CVE, GitHub Advisory).

Apply the upstream kernel patches that introduce the __free(device_node) cleanup attribute fix in logicvc_drm_config_parse(). Fixed versions are available across multiple stable branches: 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc2. Distribution-specific updates have been issued by SUSE (SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1) and openSUSE. Systems not using the logicvc DRM driver are not affected and may consider disabling or blacklisting the logicvc kernel module as a workaround (Red Hat CVE, SUSE Advisory, GitHub Advisory).