CVE-2026-89744: device property: fix infinite loop in fwnode_for_each_child_node()
In the Linux kernel, the following vulnerability has been resolved:
device property: fix infinite loop in fwnodeforeachchildnode()
When iterate over children of a fwnode that has a secondary fwnode, fwnodegetnextchildnode() can enter an infinite loop if the secondary fwnode has more than one child.
Parent Child (Primary fwnode) FWa: {FWa1, FWa2, FWa3} (Secondary fwnode) FWb: {FWb1, FWb2}
In this case:
┌─> fwnodegetnextchildnode(FWa, FWa1) │ - fwnodecallptrop(FWa, getnextchildnode, FWa1) returns FWa2 │ │ ... │ │ fwnodegetnextchildnode(FWa, FWa3) │ - fwnodecallptrop(FWa, getnextchildnode, FWa3) returns NULL │ - fwnodecallptrop(FWb, getnextchildnode, FWa3) returns FWb1 │ │ fwnodegetnextchildnode(FWa, FWb1) │ - fwnodecallptrop(FWa, getnextchildnode, FWb1) returns FWa1 └────┘
This cause fwnodeforeachchildnode() to loop indefinitely, reapeatedly output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.
The root cause is that when the current child (FWb1) belongs to the secondary fwnode, calling getnextchildnode() on the parimary fwnode incorrectly returns the first child (FWa1) again instead of NULL.
Fix this by dynamically checking the parent fwnode of the current child before calling getnextchildnode(). This approach follows the pattern established in commit b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnodegraphgetnextendpoint()").
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by this issue?
Systems are affected when code iterates child nodes of a firmware node that has a secondary firmware node with more than one child. The loop occurs when iteration reaches the secondary node's first child and incorrectly resumes at the primary node's first child.
What operational symptom indicates that this bug is being triggered?
A child-node iteration can run indefinitely, repeatedly returning the primary firmware node's children followed by the first child of the secondary firmware node. This can manifest as a hung loop or repeated processing/output of the same child-node sequence.