device property: fix infinite loop in fwnode_for_each_child_node()
In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over children of a fwnode that has a secondary fwnode, fwnode_get_next_child_node() can enter an infinite loop if the secondary fwnode has more than one child. Parent Child (Primary fwnode) FWa: {FWa1, FWa2, FWa3} (Secondary fwnode) FWb: {FWb1, FWb2} In this case: ┌─> fwnode_get_next_child_node(FWa, FWa1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2 │ │ ... │ │ fwnode_get_next_child_node(FWa, FWa3) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL │ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1 │ │ fwnode_get_next_child_node(FWa, FWb1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1 └────┘ This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}. The root cause is that when the current child (FWb1) belongs to the secondary fwnode, calling get_next_child_node() on the parimary fwnode incorrectly returns the first child (FWa1) again instead of NULL. Fix this by dynamically checking the parent fwnode of the current child before calling get_next_child_node(). This approach follows the pattern established in commit b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()").
CVE-2026-89744
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-89744
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "272fcf19fda14ec603ce915aafc56cb3ea2fb38d",
"lessThan": "04004fa33730031392d987a9c1bbd8a0e1c4794b",
"versionType": "git"
},
{
"status": "affected",
"version": "3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6",
"lessThan": "f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0",
"versionType": "git"
},
{
"status": "affected",
"version": "64dc258f9eec1d7204e9879cb836fe29967f1239",
"lessThan": "20ed517e416df89448029293304c9e180c26cd4b",
"versionType": "git"
},
{
"status": "affected",
"version": "32752c3e81498b106da64a141379eb94f493fe6f",
"lessThan": "ba69d892ff4e4a58cc12a2cae106b112db3306cc",
"versionType": "git"
},
{
"status": "affected",
"version": "2692c614f8f05929d692b3dbfd3faef1f00fbaf0",
"lessThan": "9cb6b223ef02cb5c9777a852ae1ecf5796987eb6",
"versionType": "git"
},
{
"status": "affected",
"version": "2692c614f8f05929d692b3dbfd3faef1f00fbaf0",
"lessThan": "1900692555826753adab8799a1a8d50bb1ee200c",
"versionType": "git"
},
{
"status": "affected",
"version": "d1370a4f2aa0d811d419f6a6c6d257867d608956",
"versionType": "git"
},
{
"status": "affected",
"version": "5b51b2ba5207e07bcd7be0daab2f8eea405e005e",
"versionType": "git"
},
{
"status": "affected",
"version": "43a621684ffa47fc008be98b15ff7becaf3a72fa",
"versionType": "git"
},
{
"status": "affected",
"version": "6.1.167",
"lessThan": "6.1.188",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.130",
"lessThan": "6.6.157",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.78",
"lessThan": "6.12.109",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.18.19",
"lessThan": "6.18.50",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.10.253",
"lessThan": "5.11",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.203",
"lessThan": "5.16",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.19.9",
"lessThan": "6.20",
"versionType": "semver"
}
],
"programFiles": [
"drivers/base/property.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/base/property.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-89744
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #35218 · Revision 1
- Added to Heist Feed
- Publisher date