CVE-2026-64249: fpga: region: fix use-after-free in child_regions_with_firmware()
In the Linux kernel, the following vulnerability has been resolved:
fpga: region: fix use-after-free in childregionswithfirmware()
Move ofnodeput(childregion) after the error print to avoid accessing freed memory when prerr() references childregion.
[ Yilun: Fix the Fixes tag ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the upstream Linux kernel patch titled "Move of_node_put(child_region) after the error print" (fpga: region: fix use-after-free in child_regions_with_firmware()) to avoid use-after-free when pr_err() references child_region.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel FPGA region functionality are relevant, specifically when child FPGA regions with firmware are processed. The provided data does not identify affected kernel versions, distributions, or hardware platforms.
What access and conditions are needed to exploit it?
Exploitation requires local access, low privileges, and no user interaction according to the CVSS vector. The issue is a use-after-free triggered when an error is logged after a child region device-tree node has been released.
Is there a mitigation if an updated kernel cannot be deployed immediately?
The provided data only states that the vulnerability has been resolved in the referenced stable kernel commits. If patching cannot occur immediately, no supported workaround or configuration mitigation is specified.