316 lines
17 KiB
JSON
316 lines
17 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-89744",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-11T19:38:34.762Z",
|
|
"datePublished": "2026-09-11T19:46:50.020Z",
|
|
"dateUpdated": "2026-10-30T12:32:54.954Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:32:54.954Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndevice property: fix infinite loop in fwnode_for_each_child_node()\n\nWhen iterate over children of a fwnode that has a secondary fwnode,\nfwnode_get_next_child_node() can enter an infinite loop if the secondary\nfwnode has more than one child.\n\n Parent Child\n (Primary fwnode) FWa: {FWa1, FWa2, FWa3}\n (Secondary fwnode) FWb: {FWb1, FWb2}\n\nIn this case:\n\n ┌─> fwnode_get_next_child_node(FWa, FWa1)\n │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2\n │\n │ ...\n │\n │ fwnode_get_next_child_node(FWa, FWa3)\n │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL\n │ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1\n │\n │ fwnode_get_next_child_node(FWa, FWb1)\n │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1\n └────┘\n\nThis cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly\noutput {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.\n\nThe root cause is that when the current child (FWb1) belongs to the\nsecondary fwnode, calling get_next_child_node() on the parimary fwnode\nincorrectly returns the first child (FWa1) again instead of NULL.\n\nFix this by dynamically checking the parent fwnode of the current child\nbefore calling get_next_child_node(). This approach follows the pattern\nestablished in commit b5b41ab6b0c1 (\"device property: Check\nfwnode->secondary in fwnode_graph_get_next_endpoint()\")."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 8.4,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - fwnode_get_next_child_node() is reached from local driver-core fw_devlink and device_for_each_child_node() during device_add/bind/probe (GPIO, LEDs, IIO, MFD, camera), not from network or remote protocol parsing.\nAC:L - On OF platforms whose primary node has children and a secondary software node also has children, of_get_next_available_child() treats a non-OF child as prev=NULL and restarts at the first OF child, so the loop is deterministic with no race or layout dependency.\nPR:N - No capability or credential check exists on this path; fw_devlink_parse_fwtree()/fw_devlink_pickup_dangling_consumers() and driver probe walk mixed primary/secondary children automatically at boot and hotplug bind on phones, embedded boards, and Galileo GPIO.\nUI:N - Firmware-node child walks run inside kernel device registration, fw_devlink, and driver probe without any victim action such as mounting a filesystem or opening a user-supplied file.\nS:U - The hang and firmware-node use-after-free stay inside the host kernel's device-property/OF layer and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - Crossing from the last OF child into the secondary node makes software_node_get_next_child() put an already-dropped OF node, underflowing its refcount and freeing it while sibling iteration continues, a use-after-free of firmware-node memory.\nI:H - The extra put leaves the last primary child freed but still linked in the OF sibling list; the next of_get_next_available_child() follows that dangling sibling into freed device_node memory, enabling heap-spray write and control-flow hijack.\nA:H - fwnode_for_each_child_node() spins forever in probe/fw_devlink process context, causing a soft lockup or hung task, and the OF-node use-after-free can also oops or panic the host."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/base/property.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "d1370a4f2aa0d811d419f6a6c6d257867d608956",
|
|
"lessThan": "45a8fc4a12751833ed3868095d18200a85336760",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5b51b2ba5207e07bcd7be0daab2f8eea405e005e",
|
|
"lessThan": "770c9bde93c8bb644f590743e9fbae3492a20f9e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "272fcf19fda14ec603ce915aafc56cb3ea2fb38d",
|
|
"lessThan": "04004fa33730031392d987a9c1bbd8a0e1c4794b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6",
|
|
"lessThan": "f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "64dc258f9eec1d7204e9879cb836fe29967f1239",
|
|
"lessThan": "20ed517e416df89448029293304c9e180c26cd4b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "32752c3e81498b106da64a141379eb94f493fe6f",
|
|
"lessThan": "ba69d892ff4e4a58cc12a2cae106b112db3306cc",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2692c614f8f05929d692b3dbfd3faef1f00fbaf0",
|
|
"lessThan": "9cb6b223ef02cb5c9777a852ae1ecf5796987eb6",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2692c614f8f05929d692b3dbfd3faef1f00fbaf0",
|
|
"lessThan": "1900692555826753adab8799a1a8d50bb1ee200c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "43a621684ffa47fc008be98b15ff7becaf3a72fa",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5.10.253",
|
|
"lessThan": "5.10.273",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.203",
|
|
"lessThan": "5.15.224",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.167",
|
|
"lessThan": "6.1.188",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.130",
|
|
"lessThan": "6.6.157",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.78",
|
|
"lessThan": "6.12.109",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.19",
|
|
"lessThan": "6.18.50",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.19.9",
|
|
"lessThan": "6.20",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/base/property.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "7.0",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "7.0",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.273",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.224",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.188",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.157",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.109",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.50",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.4",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.10.253",
|
|
"versionEndExcluding": "5.10.273"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15.203",
|
|
"versionEndExcluding": "5.15.224"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.1.167",
|
|
"versionEndExcluding": "6.1.188"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.6.130",
|
|
"versionEndExcluding": "6.6.157"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.12.78",
|
|
"versionEndExcluding": "6.12.109"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.18.19",
|
|
"versionEndExcluding": "6.18.50"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "7.0",
|
|
"versionEndExcluding": "7.2.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "7.0",
|
|
"versionEndExcluding": "7.3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.19.9"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/45a8fc4a12751833ed3868095d18200a85336760"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/770c9bde93c8bb644f590743e9fbae3492a20f9e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/04004fa33730031392d987a9c1bbd8a0e1c4794b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/20ed517e416df89448029293304c9e180c26cd4b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/ba69d892ff4e4a58cc12a2cae106b112db3306cc"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/9cb6b223ef02cb5c9777a852ae1ecf5796987eb6"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1900692555826753adab8799a1a8d50bb1ee200c"
|
|
}
|
|
],
|
|
"title": "device property: fix infinite loop in fwnode_for_each_child_node()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |