Answer in brief
CVE-2026-43264 records a Unknown severity vulnerability in fbdev: of: display_timing: fix refcount leak in of_get_display_timings(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=cc3f414cf2e404130584b63d373161ba6fd24bc2 <20881ad42e651c69d89eb38a2042838187900fd6 || >=cc3f414cf2e404130584b63d373161ba6fd24bc2 <b5bdcc5afbff845834d04d651773cb6b47db5dd3 || >=cc3f414cf2e404130584b63d373161ba6fd24bc2 <2b22e4fe1273c24f405ed7903349c4bbd82b6368 || >=cc3f414cf2e404130584b63d373161ba6fd24bc2 <3ed019654234edb8625c05d05e15d40f74e64f70 || >=cc3f414cf2e404130584b63d373161ba6fd24bc2 <d6f34bbff07476c6abb8672c89d217824871c5ed || >=cc3f414cf2e404130584b63d373161ba6fd24bc2 <69290f2d3999c5fa1a7f5d5593cfc5461fa3ee64 || >=cc3f414cf2e404130584b63d373161ba6fd24bc2 <c5734f9030a8b1e13868d1641b5163d8e659306e || >=cc3f414cf2e404130584b63d373161ba6fd24bc2 <eacf9840ae1285a1ef47eb0ce16d786e542bd4d7 | 20881ad42e651c69d89eb38a2042838187900fd6, b5bdcc5afbff845834d04d651773cb6b47db5dd3, 2b22e4fe1273c24f405ed7903349c4bbd82b6368, 3ed019654234edb8625c05d05e15d40f74e64f70, d6f34bbff07476c6abb8672c89d217824871c5ed, 69290f2d3999c5fa1a7f5d5593cfc5461fa3ee64, c5734f9030a8b1e13868d1641b5163d8e659306e, eacf9840ae1285a1ef47eb0ce16d786e542bd4d7 |
| Linux/Linuxgeneric | 3.9 | Not reported |
Published upstream
May 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 6, 2026
In the Linux kernel, the following vulnerability has been resolved: fbdev: of: display_timing: fix refcount leak in of_get_display_timings() of_parse_phandle() returns a device_node with refcount incremented, which is stored in 'entry' and then copied to 'native_mode'. When the error paths at lines 184 or 192 jump to 'entryfail', native_mode's refcount is not decremented, causing a refcount leak. Fix this by changing the goto target from 'entryfail' to 'timingfail', which properly calls of_node_put(native_mode) before cleanup.
Quoted source text, attributed separately from HOL analysis.