{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-89744", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-89744", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-09-11T19:46:50.020Z", "updatedAt": "2026-10-19T08:51:58.192Z", "importedAt": "2026-10-24T01:58:35.090Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "device property: fix infinite loop in fwnode_for_each_child_node()", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ndevice property: fix infinite loop in fwnode_for_each_child_node()\n\nWhen iterate over children of a fwnode that has a secondary fwnode,\nfwnode_get_next_child_node() can enter an infinite loop if the secondary\nfwnode has more than one child.\n\n Parent Child\n (Primary fwnode) FWa: {FWa1, FWa2, FWa3}\n (Secondary fwnode) FWb: {FWb1, FWb2}\n\nIn this case:\n\n ┌─> fwnode_get_next_child_node(FWa, FWa1)\n │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2\n │\n │ ...\n │\n │ fwnode_get_next_child_node(FWa, FWa3)\n │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL\n │ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1\n │\n │ fwnode_get_next_child_node(FWa, FWb1)\n │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1\n └────┘\n\nThis cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly\noutput {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.\n\nThe root cause is that when the current child (FWb1) belongs to the\nsecondary fwnode, calling get_next_child_node() on the parimary fwnode\nincorrectly returns the first child (FWa1) again instead of NULL.\n\nFix this by dynamically checking the parent fwnode of the current child\nbefore calling get_next_child_node(). This approach follows the pattern\nestablished in commit b5b41ab6b0c1 (\"device property: Check\nfwnode->secondary in fwnode_graph_get_next_endpoint()\").", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "272fcf19fda14ec603ce915aafc56cb3ea2fb38d", "status": "affected", "versionType": "git", "lessThan": "04004fa33730031392d987a9c1bbd8a0e1c4794b" }, { "version": "3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6", "status": "affected", "versionType": "git", "lessThan": "f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0" }, { "version": "64dc258f9eec1d7204e9879cb836fe29967f1239", "status": "affected", "versionType": "git", "lessThan": "20ed517e416df89448029293304c9e180c26cd4b" }, { "version": "32752c3e81498b106da64a141379eb94f493fe6f", "status": "affected", "versionType": "git", "lessThan": "ba69d892ff4e4a58cc12a2cae106b112db3306cc" }, { "version": "2692c614f8f05929d692b3dbfd3faef1f00fbaf0", "status": "affected", "versionType": "git", "lessThan": "9cb6b223ef02cb5c9777a852ae1ecf5796987eb6" }, { "version": "2692c614f8f05929d692b3dbfd3faef1f00fbaf0", "status": "affected", "versionType": "git", "lessThan": "1900692555826753adab8799a1a8d50bb1ee200c" }, { "version": "d1370a4f2aa0d811d419f6a6c6d257867d608956", "status": "affected", "versionType": "git" }, { "version": "5b51b2ba5207e07bcd7be0daab2f8eea405e005e", "status": "affected", "versionType": "git" }, { "version": "43a621684ffa47fc008be98b15ff7becaf3a72fa", "status": "affected", "versionType": "git" }, { "version": "6.1.167", "status": "affected", "versionType": "semver", "lessThan": "6.1.188" }, { "version": "6.6.130", "status": "affected", "versionType": "semver", "lessThan": "6.6.157" }, { "version": "6.12.78", "status": "affected", "versionType": "semver", "lessThan": "6.12.109" }, { "version": "6.18.19", "status": "affected", "versionType": "semver", "lessThan": "6.18.50" }, { "version": "5.10.253", "status": "affected", "versionType": "semver", "lessThan": "5.11" }, { "version": "5.15.203", "status": "affected", "versionType": "semver", "lessThan": "5.16" }, { "version": "6.19.9", "status": "affected", "versionType": "semver", "lessThan": "6.20" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "7.0", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "7.0" }, { "version": "6.1.188", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.157", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.109", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.50", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "7.2.4", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "7.2.*" }, { "version": "7.3", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }