CVE-2026-89504 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux system administrators, and users of Linux-based systems should assess exposure and verify if their systems are affected by this vulnerability. This includes reviewing Linux kernel versions and configurations, as well as checking for any existing patches or updates that address this vulnerability. Additionally, operators, platform administrators, and security teams may need to be involved in the verification and remediation过程

Why it matters

A vulnerability in the Linux kernel has been resolved, where the regulator: as3722_get_regulator_dt_data function could potentially leave a dangling of_node pointer. Linux kernel maintainers and users should assess exposure and verify if their systems hold references to the affected of_node.

• Verification of Linux kernel versions and configurations is necessary to determine exposure.
• Systems holding references to the affected of_node may require updates to the latest Linux kernel version.

Technical summary

The regulator: as3722_get_regulator_dt_data function in the Linux kernel could potentially leave a dangling of_node pointer due to premature of_node_put(np) call. This occurs because of_get_child_by_name() acquires a reference on np, which is then assigned to pdev->dev.of_node, but the function immediately calls of_node_put(np), releasing the reference. Linux kernel maintainers and users should assess exposure and verify if their systems hold references to the affected of_node, potentially requiring updates to the latest Linux kernel version.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify if their systems hold references to the affected of_node.

Recommended defensive actions

• Review Linux kernel versions and configurations for exposure to this vulnerability.
• Verify if systems hold references to the affected of_node.
• Update to the latest Linux kernel version if necessary.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected systems and versions requires further verification from official Linux kernel sources. Linux kernel maintainers and users should verify if their systems hold references to the affected of_node and assess exposure. This may involve reviewing Linux kernel versions and configurations, as well as checking for any existing patches or updates that address this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.