CVE-2026-89744 is a vulnerability in Linux Kernel
Published on September 11, 2026
device property: fix infinite loop in fwnode_for_each_child_node()
In the Linux kernel, the following vulnerability has been resolved:
device property: fix infinite loop in fwnode_for_each_child_node()
When iterate over children of a fwnode that has a secondary fwnode,
fwnode_get_next_child_node() can enter an infinite loop if the secondary
fwnode has more than one child.
Parent Child
(Primary fwnode) FWa: {FWa1, FWa2, FWa3}
(Secondary fwnode) FWb: {FWb1, FWb2}
In this case:
> fwnode_get_next_child_node(FWa, FWa1)
- fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2
...
fwnode_get_next_child_node(FWa, FWa3)
- fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL
- fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1
fwnode_get_next_child_node(FWa, FWb1)
- fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1
This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly
output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.
The root cause is that when the current child (FWb1) belongs to the
secondary fwnode, calling get_next_child_node() on the parimary fwnode
incorrectly returns the first child (FWa1) again instead of NULL.
Fix this by dynamically checking the parent fwnode of the current child
before calling get_next_child_node(). This approach follows the pattern
established in commit b5b41ab6b0c1 ("device property: Check
fwnode->secondary in fwnode_graph_get_next_endpoint()").
Products Associated with CVE-2026-89744
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 64dc258f9eec1d7204e9879cb836fe29967f1239 and below 20ed517e416df89448029293304c9e180c26cd4b is affected.
- Version 32752c3e81498b106da64a141379eb94f493fe6f and below ba69d892ff4e4a58cc12a2cae106b112db3306cc is affected.
- Version 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 and below 9cb6b223ef02cb5c9777a852ae1ecf5796987eb6 is affected.
- Version 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 and below 1900692555826753adab8799a1a8d50bb1ee200c is affected.
- Version d1370a4f2aa0d811d419f6a6c6d257867d608956 is affected.
- Version 5b51b2ba5207e07bcd7be0daab2f8eea405e005e is affected.
- Version 272fcf19fda14ec603ce915aafc56cb3ea2fb38d is affected.
- Version 3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6 is affected.
- Version 43a621684ffa47fc008be98b15ff7becaf3a72fa is affected.
- Version 6.12.78 and below 6.12.109 is affected.
- Version 6.18.19 and below 6.18.50 is affected.
- Version 5.10.253 and below 5.11 is affected.
- Version 5.15.203 and below 5.16 is affected.
- Version 6.1.167 and below 6.2 is affected.
- Version 6.6.130 and below 6.7 is affected.
- Version 6.19.9 and below 6.20 is affected.
- Version 7.0 is affected.
- Before 7.0 is unaffected.
- Version 6.12.109, <= 6.12.* is unaffected.
- Version 6.18.50, <= 6.18.* is unaffected.
- Version 7.2.4, <= 7.2.* is unaffected.
- Version 7.3-rc1, <= * is unaffected.