Medium 5.5Published May 6, 2026

CVE-2026-43264fbdev: of: display_timing: fix refcount leak in of_get_display_timings()

Updated under an hour ago (Oct 27, 2026, 12:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: fbdev: of: display_timing: fix refcount leak in of_get_display_timings() of_parse_phandle() returns a device_node with refcount incremented, which is stored in 'entry' and then copied to 'native_mode'. When the error paths at lines 184 or 192 jump to 'entryfail', native_mode's refcount is not decremented, causing a refcount leak. Fix this by changing the goto target from 'entryfail' to 'timingfail', which properly calls of_node_put(native_mode) before cleanup.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from cc3f414cf2e404130584b63d373161ba6fd24bc2 before 20881ad42e651c69d89eb38a2042838187900fd6; from cc3f414cf2e404130584b63d373161ba6fd24bc2 before b5bdcc5afbff845834d04d651773cb6b47db5dd3; from cc3f414cf2e404130584b63d373161ba6fd24bc2 before 2b22e4fe1273c24f405ed7903349c4bbd82b6368; from cc3f414cf2e404130584b63d373161ba6fd24bc2 before 3ed019654234edb8625c05d05e15d40f74e64f70; from cc3f414cf2e404130584b63d373161ba6fd24bc2 before d6f34bbff07476c6abb8672c89d217824871c5ed; from cc3f414cf2e404130584b63d373161ba6fd24bc2 before 69290f2d3999c5fa1a7f5d5593cfc5461fa3ee64; from cc3f414cf2e404130584b63d373161ba6fd24bc2 before c5734f9030a8b1e13868d1641b5163d8e659306e; from cc3f414cf2e404130584b63d373161ba6fd24bc2 before eacf9840ae1285a1ef47eb0ce16d786e542bd4d7	CNA record
linux linux_kernel linux:linux_kernel	from 3.9 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/20881ad42e651c69d89eb38a2042838187900fd6	patch
https://git.kernel.org/stable/c/b5bdcc5afbff845834d04d651773cb6b47db5dd3	patch
https://git.kernel.org/stable/c/2b22e4fe1273c24f405ed7903349c4bbd82b6368	patch
https://git.kernel.org/stable/c/3ed019654234edb8625c05d05e15d40f74e64f70	patch
https://git.kernel.org/stable/c/d6f34bbff07476c6abb8672c89d217824871c5ed	patch
https://git.kernel.org/stable/c/69290f2d3999c5fa1a7f5d5593cfc5461fa3ee64	patch
https://git.kernel.org/stable/c/c5734f9030a8b1e13868d1641b5163d8e659306e	patch
https://git.kernel.org/stable/c/eacf9840ae1285a1ef47eb0ce16d786e542bd4d7	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.