CVE-2026-89504

A reference-counting bug in the Linux kernel's AS3722 PMIC regulator driver causes as3722_get_regulator_dt_data() to release a device-tree node reference (via of_node_put) while the device still holds a pointer to that node, leaving pdev->dev.of_node dangling. Any later code that dereferences the device's of_node pointer operates on freed memory, which can corrupt kernel state and potentially lead to privilege escalation, data disclosure, or a crash. The flaw is triggered locally during driver probing and later device-tree access on systems using the ams,as3722 regulator hardware, requiring no privileges or user interaction per the CVSS vector. Affected systems are limited to devices whose hardware is described by an AS3722 PMIC node, mainly certain NVIDIA Tegra-based embedded boards. No public proof of concept is known, and there is no evidence of in-the-wild exploitation.

What to do: Apply a kernel update that includes the fix (removal of the of_node_put(np) call so the device retains its node reference) as soon as your distribution ships it. Verify whether your systems actually instantiate the as3722 regulator driver (e.g., check for an ams,as3722 node in the device tree) before prioritizing emergency reboots. Because exploitation requires local access, restricting local untrusted accounts and shell access on affected embedded devices is a reasonable interim mitigation.