CVE-2026-68461

Received Received - Intake

Linux Kernel Device Property Use-After-Free Vulnerability

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnode_handle in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitialized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization. While at it: initialize the remaining fields of struct fwnode_handle too just to be sure. [ Fix typo in commit message. - Danilo ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-68461

EUVD

EUVD-2026-59083

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves uninitialized memory in firmware node structures. When a firmware node is allocated on the stack or heap without zeroing, the fwnode_handle structure's secondary pointer may contain garbage values. This could lead to incorrect dereferencing, potentially causing crashes or unexpected behavior when the node is used.

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to improper initialization of firmware node structures. Detection requires checking kernel versions and examining kernel logs for related errors. Use commands like 'uname -a' to check kernel version and 'dmesg | grep fwnode' to look for related errors.

Impact Analysis

If exploited, this flaw could allow attackers to trigger kernel crashes or execute arbitrary code with kernel privileges. Systems using affected Linux kernel versions may experience instability or security breaches. Users should update their kernels to patched versions to mitigate risks.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level Linux kernel issue related to uninitialized memory in firmware node handling, which could lead to undefined behavior but does not inherently violate data protection or privacy regulations.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If immediate updates are not possible, avoid using non-zeroing allocation functions for firmware nodes and ensure proper initialization of all fwnode_handle fields.

Hi! I’m here to help you understand CVE-2026-68461. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70