CVE-2026-89744

Received Received - Intake

Infinite Loop in Linux Kernel Device Property Handling

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over children of a fwnode that has a secondary fwnode, fwnode_get_next_child_node() can enter an infinite loop if the secondary fwnode has more than one child. Parent Child (Primary fwnode) FWa: {FWa1, FWa2, FWa3} (Secondary fwnode) FWb: {FWb1, FWb2} In this case: ┌─> fwnode_get_next_child_node(FWa, FWa1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2 │ │ ... │ │ fwnode_get_next_child_node(FWa, FWa3) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL │ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1 │ │ fwnode_get_next_child_node(FWa, FWb1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1 └────┘ This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}. The root cause is that when the current child (FWb1) belongs to the secondary fwnode, calling get_next_child_node() on the parimary fwnode incorrectly returns the first child (FWa1) again instead of NULL. Fix this by dynamically checking the parent fwnode of the current child before calling get_next_child_node(). This approach follows the pattern established in commit b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89744

EUVD

EUVD-2026-76656

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's device property handling. It causes an infinite loop when iterating over child nodes of a firmware node that has a secondary firmware node with multiple children. The loop occurs because the function incorrectly returns to the first child node instead of stopping when it should.

Detection Guidance

This vulnerability is specific to the Linux kernel's device property handling and does not have a direct network detection method. To check if your system is affected, verify the kernel version against patched versions. Use 'uname -r' to check the kernel version and compare it with the fixed release.

Impact Analysis

This could cause system hangs or crashes when software attempts to enumerate device properties, leading to denial of service. It primarily affects systems using complex device trees with secondary firmware nodes.

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for CVE-2026-89744. This resolves the infinite loop in fwnode_for_each_child_node(). Check your distribution's security advisories for the patched kernel version and apply it immediately.

Hi! I’m here to help you understand CVE-2026-89744. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70