CVE-2026-89504 regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
A use-after-free vulnerability in the Linux kernel's as3722 regulator driver allows attackers to cause denial of service or execute arbitrary code via a dangling pointer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89504?
CVE-2026-89504 is a high-severity use after free vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
In as3722_get_regulator_dt_data(), of_get_child_by_name() acquires a reference on np, which is then assigned to pdev->dev.of_node. The function immediately calls of_node_put(np), releasing the reference and leaving pdev->dev.of_node as a dangling pointer.
Remove the of_node_put(np) call to let the device hold the reference.
Which versions are affected by CVE-2026-89504?
How do I fix CVE-2026-89504?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-89504 being exploited?
There is no known exploitation of CVE-2026-89504 in the wild and no public exploit code.
Sources
Also known as AZL-100187, BELL-CVE-2026-89504, DEBIAN-CVE-2026-89504, GHSA-w8c6-qh9v-m8g2, UBUNTU-CVE-2026-89504.