HIGH
property FwnodeChild Loop
CVE-2026-89744
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.2MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over children of a fwnode that has a secondary fwnode, fwnode_get_next_child_node() can enter an infinite loop if the secondary fwnode has more than one child. Parent Child (Primary fwnode) FWa: {FWa1, FWa2, FWa3} (Secondary fwnode) FWb: {FWb1, FWb2} In this case: ┌─> fwnode_get_next_child_node(FWa, FWa1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2 │ │ ... │ │ fwnode_get_next_child_node(FWa, FWa3) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL │ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1 │ │ fwnode_get_next_child_node(FWa, FWb1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1 └────┘ This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}. The root cause is that when the current child (FWb1) belongs to the secondary fwnode, calling get_next_child_node() on the parimary fwnode incorrectly returns the first child (FWa1) again instead of NULL. Fix this by dynamically checking the parent fwnode of the current child before calling get_next_child_node(). This approach follows the pattern established in commit b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()").
02KernelScan AI Analysis
Risk summary
A logic flaw in the kernel's device property iteration code causes an infinite loop when enumerating children of a firmware node that has a secondary node with more than one child. Any system with such a device configuration will hang during device probing, resulting in a local denial of service. The bug is in core infrastructure used across all kernel subsystems that enumerate device children.
Vulnerability analysis
When the kernel iterates over the children of a firmware node that has an attached secondary node, the iteration helper can enter an infinite loop if the secondary node contains more than one child. After exhausting the primary node's children and moving to the secondary, the helper incorrectly queries the primary node again for the next child, which restarts the iteration from the beginning instead of advancing. The fix dynamically determines which node the current child actually belongs to and uses that node as the parent for the next lookup, and when the primary's children are exhausted it begins a fresh iteration on the secondary node rather than passing the secondary child back to the primary. This code path is reached during device enumeration—typically at boot or on hotplug—on any system whose firmware or driver configuration creates a secondary firmware node with multiple children.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 6.1.167 | 6.1.188 | 04004fa33730 |
| 6.12 | 6.12.78 | 6.12.109 | 20ed517e416d |
| 6.18 | 6.18.19 | 6.18.50 | ba69d892ff4e |
| 5.10 | 5.10.253 | 5.11 | 9cb6b223ef02 |
| 5.15 | 5.15.203 | 5.16 | 190069255582 |
| 6.19 | 6.19.9 | 6.20 | — |
| 7.2 | — | 7.2.4 | — |
| mainline | — | 7.3-rc1 | — |
| 6.6 | 6.6.130 | 6.6.157 | f4ae79b5f001 |
| cip/6.12 | — | 6.12.111-cip32 | 20ed517e416d |