Device Property Vulnerability in Linux Kernel Affecting Multiple Releases

CVE-2026-89744

What is CVE-2026-89744?

The Linux kernel contains a vulnerability in the device property management system that can lead to an infinite loop when iterating over child nodes of a fwnode. Specifically, the function fwnode_get_next_child_node() may repeatedly return the first child of a primary fwnode when a secondary fwnode is present with multiple children, causing potential system hangs. This flaw arises when the current child belongs to a secondary fwnode, resulting in an erroneous recursive call to get_next_child_node() on the primary fwnode. A patch has been implemented to dynamically check the parent fwnode before invoking this function, addressing the loop issue.

References