CVE-2026-63906 | In the Linux kernel, the following vulnerability has been re… | CVSS 8.4 HIGH

Description

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430_probe() In omap2430_probe(), of_node_put(np) is called prematurely before the last access to np, leading to a use-after-free if the node's reference count drops to zero. Move the of_node_put() calls after the last use of np in both the success and error paths.

Metadata

CVE ID: CVE-2026-63906
State: PUBLISHED
Assigner: Linux
Reserved: 2026-07-19 07:54 UTC
Published: 2026-07-19 14:55 UTC
Last updated: 2026-07-20 13:41 UTC
Vendor / Product: Linux / Linux
Sources: cve.org · NVD

Severity & Metrics

8.4 HIGH CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products (2)

Vendor	Product	Platform	Versions
Linux	Linux	—	22b60658a90260e3fbd57824e3afe5682c6afcf5 < 632fd888fe33083927e29ef651ac1aba345edd9e, ffbe2feac59b37c8dc536727552b4f375e1b9aec < b987f380620b38c84f054d5ff5c05861a7c2203b, ffbe2feac59b37c8dc536727552b4f375e1b9aec < 27e62532228dc42367bb43ebbcd7bf49d8db2b0d, ffbe2feac59b37c8dc536727552b4f375e1b9aec < 69f9f2b30af03d9b6e83f78fb0f734b6066d4678 …
Linux	Linux	—	6.2, 0 < 6.2, 6.1.176 ≤ 6.1., 6.6.143 ≤ 6.6. …

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.4	HIGH	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (6)