CVE-2026-89744: device property: fix infinite loop in fwnode_for_each_child_node()
In the Linux kernel, the following vulnerability has been resolved:
device property: fix infinite loop in fwnodeforeachchildnode()
When iterate over children of a fwnode that has a secondary fwnode, fwnodegetnextchildnode() can enter an infinite loop if the secondary fwnode has more than one child.
Parent Child (Primary fwnode) FWa: {FWa1, FWa2, FWa3} (Secondary fwnode) FWb: {FWb1, FWb2}
In this case:
┌─> fwnodegetnextchildnode(FWa, FWa1) │ - fwnodecallptrop(FWa, getnextchildnode, FWa1) returns FWa2 │ │ ... │ │ fwnodegetnextchildnode(FWa, FWa3) │ - fwnodecallptrop(FWa, getnextchildnode, FWa3) returns NULL │ - fwnodecallptrop(FWb, getnextchildnode, FWa3) returns FWb1 │ │ fwnodegetnextchildnode(FWa, FWb1) │ - fwnodecallptrop(FWa, getnextchildnode, FWb1) returns FWa1 └────┘
This cause fwnodeforeachchildnode() to loop indefinitely, reapeatedly output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.
The root cause is that when the current child (FWb1) belongs to the secondary fwnode, calling getnextchildnode() on the parimary fwnode incorrectly returns the first child (FWa1) again instead of NULL.
Fix this by dynamically checking the parent fwnode of the current child before calling getnextchildnode(). This approach follows the pattern established in commit b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnodegraphgetnextendpoint()").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.188 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.109 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.50 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Modify fwnode_get_next_child_node() to dynamically check the parent fwnode of the current child before calling get_next_child_node(), so iteration switches to the secondary fwnode when the current child belongs to it and avoids the infinite loop.
Event History
Frequently Asked Questions
Which systems are affected by this issue?
Systems are affected when code iterates child nodes of a firmware node that has a secondary firmware node with more than one child. The loop occurs when iteration reaches the secondary node's first child and incorrectly resumes at the primary node's first child.
What operational symptom indicates that this bug is being triggered?
A child-node iteration can run indefinitely, repeatedly returning the primary firmware node's children followed by the first child of the secondary firmware node. This can manifest as a hung loop or repeated processing/output of the same child-node sequence.