Linux Kernel Vulnerability in Device Property Management

CVE-2026-64220

What is CVE-2026-64220?

A vulnerability exists in the Linux kernel's handling of firmware nodes, particularly regarding their initialization. When a firmware node is allocated on the stack or heap using a non-zeroing allocation function and is subsequently initialized via fwnode_init(), the secondary pointer may reference uninitialized memory. This condition risks unintended dereferencing, which could lead to unpredictable behavior and security issues. Proper initialization by setting fwnode->secondary to NULL is essential to mitigate this risk.

References