CVE-2026-89744 - Vulnerability Details

- device property: fix infinite loop in fwnode_for_each_child_node()

Description

In the Linux kernel, the following vulnerability has been resolved:

device property: fix infinite loop in fwnode_for_each_child_node()

When iterate over children of a fwnode that has a secondary fwnode,
fwnode_get_next_child_node() can enter an infinite loop if the secondary
fwnode has more than one child.

Parent Child
(Primary fwnode) FWa: {FWa1, FWa2, FWa3}
(Secondary fwnode) FWb: {FWb1, FWb2}

In this case:

┌─> fwnode_get_next_child_node(FWa, FWa1)
│ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2
│
│ ...
│
│ fwnode_get_next_child_node(FWa, FWa3)
│ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL
│ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1
│
│ fwnode_get_next_child_node(FWa, FWb1)
│ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1
└────┘

This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly
output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.

The root cause is that when the current child (FWb1) belongs to the
secondary fwnode, calling get_next_child_node() on the parimary fwnode
incorrectly returns the first child (FWa1) again instead of NULL.

Fix this by dynamically checking the parent fwnode of the current child
before calling get_next_child_node(). This approach follows the pattern
established in commit b5b41ab6b0c1 ("device property: Check
fwnode->secondary in fwnode_graph_get_next_endpoint()").

Published: 2026-09-11

Score: 4.4 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`64dc258f9eec1d7204e9879cb836fe29967f1239`	affected	< 20ed517e416df89448029293304c9e180c26cd4b
`32752c3e81498b106da64a141379eb94f493fe6f`	affected	< ba69d892ff4e4a58cc12a2cae106b112db3306cc
`2692c614f8f05929d692b3dbfd3faef1f00fbaf0`	affected	< 9cb6b223ef02cb5c9777a852ae1ecf5796987eb6
`2692c614f8f05929d692b3dbfd3faef1f00fbaf0`	affected	< 1900692555826753adab8799a1a8d50bb1ee200c
`d1370a4f2aa0d811d419f6a6c6d257867d608956`	affected	—
`5b51b2ba5207e07bcd7be0daab2f8eea405e005e`	affected	—
`272fcf19fda14ec603ce915aafc56cb3ea2fb38d`	affected	—
`3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6`	affected	—
`43a621684ffa47fc008be98b15ff7becaf3a72fa`	affected	—
`6.12.78`	affected	< 6.12.109
`6.18.19`	affected	< 6.18.50
`5.10.253`	affected	< 5.11
`5.15.203`	affected	< 5.16
`6.1.167`	affected	< 6.2
`6.6.130`	affected	< 6.7
`6.19.9`	affected	< 6.20

Linux

affected

Version	Status	Constraints
`7.0`	affected	—
`0`	unaffected	< 7.0
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1900692555826753adab8799a1a8d50bb1ee200c
https://git.kernel.org/stable/c/20ed517e416df89448029293304c9e180c26cd4b
https://git.kernel.org/stable/c/9cb6b223ef02cb5c9777a852ae1ecf5796987eb6
https://git.kernel.org/stable/c/ba69d892ff4e4a58cc12a2cae106b112db3306cc
https://nvd.nist.gov/vuln/detail/CVE-2026-89744
https://www.cve.org/CVERecord?id=CVE-2026-89744

History

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-835
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89744 https://www.cve.org/CVERecord?id=CVE-2026-89744
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over children of a fwnode that has a secondary fwnode, fwnode_get_next_child_node() can enter an infinite loop if the secondary fwnode has more than one child. Parent Child (Primary fwnode) FWa: {FWa1, FWa2, FWa3} (Secondary fwnode) FWb: {FWb1, FWb2} In this case: ┌─> fwnode_get_next_child_node(FWa, FWa1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2 │ │ ... │ │ fwnode_get_next_child_node(FWa, FWa3) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL │ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1 │ │ fwnode_get_next_child_node(FWa, FWb1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1 └────┘ This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}. The root cause is that when the current child (FWb1) belongs to the secondary fwnode, calling get_next_child_node() on the parimary fwnode incorrectly returns the first child (FWa1) again instead of NULL. Fix this by dynamically checking the parent fwnode of the current child before calling get_next_child_node(). This approach follows the pattern established in commit b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()").
Title		device property: fix infinite loop in fwnode_for_each_child_node()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1900692555826753adab8799a1a8d50bb1ee200c https://git.kernel.org/stable/c/20ed517e416df89448029293304c9e180c26cd4b https://git.kernel.org/stable/c/9cb6b223ef02cb5c9777a852ae1ecf5796987eb6 https://git.kernel.org/stable/c/ba69d892ff4e4a58cc12a2cae106b112db3306cc

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:46:50.020Z

Updated: 2026-09-11T19:46:50.020Z

Reserved: 2026-09-11T19:38:34.762Z

Link: CVE-2026-89744

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:20:05.113

Modified: 2026-09-11T20:20:05.113

Link: CVE-2026-89744

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:46:50Z

Links: CVE-2026-89744 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object