CVE-2026-93273

A low impact flaw was found in the Linux kernel TPS6594 regulator driver. While configuring multi-phase regulators in tps6594_regulator_probe(), the driver looks up buck device nodes by name and navigates to the PMIC parent node, but it never releases the acquired device node references with of_node_put(), leaking a reference on each loop iteration, and it passes the result of of_find_node_by_name() to further device tree helpers without a NULL check, which can lead to a NULL pointer dereference. A local attacker able to control device tree or platform device configuration could trigger a kernel crash, resulting in a denial of service; there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm components) are affected. Because of the low security impact, fixes for the affected streams are deferred to future updates; the residual risk is a local denial of service limited to systems that use the TPS6594 PMIC with multi-phase regulator configurations. Red Hat Enterprise Linux 6, 7, 8, and 9, including the real-time kernel, and the OpenShift Container Platform RHEL CoreOS images are not affected because the vulnerable code is not present in those offerings. Although the CVSS:3.1 base score is 5.5 (moderate), Red Hat rates the overall severity of this flaw as low because exploitation requires privileged local access to influence device probing or device tree configuration and the consequence is limited to system availability.