{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89744", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.762Z", "datePublished": "2026-09-11T19:46:50.020Z", "dateUpdated": "2026-09-11T19:46:50.020Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:46:50.020Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndevice property: fix infinite loop in fwnode_for_each_child_node()\n\nWhen iterate over children of a fwnode that has a secondary fwnode,\nfwnode_get_next_child_node() can enter an infinite loop if the secondary\nfwnode has more than one child.\n\n Parent Child\n (Primary fwnode) FWa: {FWa1, FWa2, FWa3}\n (Secondary fwnode) FWb: {FWb1, FWb2}\n\nIn this case:\n\n \u250c\u2500> fwnode_get_next_child_node(FWa, FWa1)\n \u2502 - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2\n \u2502\n \u2502 ...\n \u2502\n \u2502 fwnode_get_next_child_node(FWa, FWa3)\n \u2502 - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL\n \u2502 - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1\n \u2502\n \u2502 fwnode_get_next_child_node(FWa, FWb1)\n \u2502 - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1\n \u2514\u2500\u2500\u2500\u2500\u2518\n\nThis cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly\noutput {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.\n\nThe root cause is that when the current child (FWb1) belongs to the\nsecondary fwnode, calling get_next_child_node() on the parimary fwnode\nincorrectly returns the first child (FWa1) again instead of NULL.\n\nFix this by dynamically checking the parent fwnode of the current child\nbefore calling get_next_child_node(). This approach follows the pattern\nestablished in commit b5b41ab6b0c1 (\"device property: Check\nfwnode->secondary in fwnode_graph_get_next_endpoint()\")."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/base/property.c"], "versions": [{"version": "64dc258f9eec1d7204e9879cb836fe29967f1239", "lessThan": "20ed517e416df89448029293304c9e180c26cd4b", "status": "affected", "versionType": "git"}, {"version": "32752c3e81498b106da64a141379eb94f493fe6f", "lessThan": "ba69d892ff4e4a58cc12a2cae106b112db3306cc", "status": "affected", "versionType": "git"}, {"version": "2692c614f8f05929d692b3dbfd3faef1f00fbaf0", "lessThan": "9cb6b223ef02cb5c9777a852ae1ecf5796987eb6", "status": "affected", "versionType": "git"}, {"version": "2692c614f8f05929d692b3dbfd3faef1f00fbaf0", "lessThan": "1900692555826753adab8799a1a8d50bb1ee200c", "status": "affected", "versionType": "git"}, {"version": "d1370a4f2aa0d811d419f6a6c6d257867d608956", "status": "affected", "versionType": "git"}, {"version": "5b51b2ba5207e07bcd7be0daab2f8eea405e005e", "status": "affected", "versionType": "git"}, {"version": "272fcf19fda14ec603ce915aafc56cb3ea2fb38d", "status": "affected", "versionType": "git"}, {"version": "3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6", "status": "affected", "versionType": "git"}, {"version": "43a621684ffa47fc008be98b15ff7becaf3a72fa", "status": "affected", "versionType": "git"}, {"version": "6.12.78", "lessThan": "6.12.109", "status": "affected", "versionType": "semver"}, {"version": "6.18.19", "lessThan": "6.18.50", "status": "affected", "versionType": "semver"}, {"version": "5.10.253", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.15.203", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.1.167", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.6.130", "lessThan": "6.7", "status": "affected", "versionType": "semver"}, {"version": "6.19.9", "lessThan": "6.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/base/property.c"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.78", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.19", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.3-rc1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/20ed517e416df89448029293304c9e180c26cd4b"}, {"url": "https://git.kernel.org/stable/c/ba69d892ff4e4a58cc12a2cae106b112db3306cc"}, {"url": "https://git.kernel.org/stable/c/9cb6b223ef02cb5c9777a852ae1ecf5796987eb6"}, {"url": "https://git.kernel.org/stable/c/1900692555826753adab8799a1a8d50bb1ee200c"}], "title": "device property: fix infinite loop in fwnode_for_each_child_node()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/base/property.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "20ed517e416df89448029293304c9e180c26cd4b", "status": "affected", "version": "64dc258f9eec1d7204e9879cb836fe29967f1239", "versionType": "git"}, {"lessThan": "ba69d892ff4e4a58cc12a2cae106b112db3306cc", "status": "affected", "version": "32752c3e81498b106da64a141379eb94f493fe6f", "versionType": "git"}, {"lessThan": "9cb6b223ef02cb5c9777a852ae1ecf5796987eb6", "status": "affected", "version": "2692c614f8f05929d692b3dbfd3faef1f00fbaf0", "versionType": "git"}, {"lessThan": "1900692555826753adab8799a1a8d50bb1ee200c", "status": "affected", "version": "2692c614f8f05929d692b3dbfd3faef1f00fbaf0", "versionType": "git"}, {"status": "affected", "version": "d1370a4f2aa0d811d419f6a6c6d257867d608956", "versionType": "git"}, {"status": "affected", "version": "5b51b2ba5207e07bcd7be0daab2f8eea405e005e", "versionType": "git"}, {"status": "affected", "version": "272fcf19fda14ec603ce915aafc56cb3ea2fb38d", "versionType": "git"}, {"status": "affected", "version": "3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6", "versionType": "git"}, {"status": "affected", "version": "43a621684ffa47fc008be98b15ff7becaf3a72fa", "versionType": "git"}, {"lessThan": "6.12.109", "status": "affected", "version": "6.12.78", "versionType": "semver"}, {"lessThan": "6.18.50", "status": "affected", "version": "6.18.19", "versionType": "semver"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.253", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.203", "versionType": "semver"}, {"lessThan": "6.2", "status": "affected", "version": "6.1.167", "versionType": "semver"}, {"lessThan": "6.7", "status": "affected", "version": "6.6.130", "versionType": "semver"}, {"lessThan": "6.20", "status": "affected", "version": "6.19.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/base/property.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndevice property: fix infinite loop in fwnode_for_each_child_node()\n\nWhen iterate over children of a fwnode that has a secondary fwnode,\nfwnode_get_next_child_node() can enter an infinite loop if the secondary\nfwnode has more than one child.\n\n Parent Child\n (Primary fwnode) FWa: {FWa1, FWa2, FWa3}\n (Secondary fwnode) FWb: {FWb1, FWb2}\n\nIn this case:\n\n \u250c\u2500> fwnode_get_next_child_node(FWa, FWa1)\n \u2502 - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2\n \u2502\n \u2502 ...\n \u2502\n \u2502 fwnode_get_next_child_node(FWa, FWa3)\n \u2502 - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL\n \u2502 - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1\n \u2502\n \u2502 fwnode_get_next_child_node(FWa, FWb1)\n \u2502 - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1\n \u2514\u2500\u2500\u2500\u2500\u2518\n\nThis cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly\noutput {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.\n\nThe root cause is that when the current child (FWb1) belongs to the\nsecondary fwnode, calling get_next_child_node() on the parimary fwnode\nincorrectly returns the first child (FWa1) again instead of NULL.\n\nFix this by dynamically checking the parent fwnode of the current child\nbefore calling get_next_child_node(). This approach follows the pattern\nestablished in commit b5b41ab6b0c1 (\"device property: Check\nfwnode->secondary in fwnode_graph_get_next_endpoint()\")."}], "id": "CVE-2026-89744", "lastModified": "2026-09-11T20:20:05.113", "metrics": {}, "published": "2026-09-11T20:20:05.113", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1900692555826753adab8799a1a8d50bb1ee200c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/20ed517e416df89448029293304c9e180c26cd4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9cb6b223ef02cb5c9777a852ae1ecf5796987eb6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba69d892ff4e4a58cc12a2cae106b112db3306cc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Denial of Service due to infinite loop in device property handling", "id": "2532312", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532312"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["A flaw was found in the Linux kernel's device property handling. When the kernel iterates over child nodes of a firmware node (fwnode) that also has a secondary fwnode, the `fwnode_get_next_child_node()` function can enter an endless loop. This occurs if the secondary fwnode has multiple children, causing the primary fwnode to incorrectly return an already processed child instead of indicating no further children. This vulnerability can lead to a Denial of Service (DoS), making the system unresponsive."], "name": "CVE-2026-89744", "public_date": "2026-09-11T19:46:50Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89744\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89744\nhttps://git.kernel.org/stable/c/1900692555826753adab8799a1a8d50bb1ee200c\nhttps://git.kernel.org/stable/c/20ed517e416df89448029293304c9e180c26cd4b\nhttps://git.kernel.org/stable/c/9cb6b223ef02cb5c9777a852ae1ecf5796987eb6\nhttps://git.kernel.org/stable/c/ba69d892ff4e4a58cc12a2cae106b112db3306cc"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[64dc258f9eec1d7204e9879cb836fe29967f1239,20ed517e416df89448029293304c9e180c26cd4b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[32752c3e81498b106da64a141379eb94f493fe6f,ba69d892ff4e4a58cc12a2cae106b112db3306cc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2692c614f8f05929d692b3dbfd3faef1f00fbaf0,9cb6b223ef02cb5c9777a852ae1ecf5796987eb6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2692c614f8f05929d692b3dbfd3faef1f00fbaf0,1900692555826753adab8799a1a8d50bb1ee200c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "d1370a4f2aa0d811d419f6a6c6d257867d608956"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "5b51b2ba5207e07bcd7be0daab2f8eea405e005e"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "272fcf19fda14ec603ce915aafc56cb3ea2fb38d"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "43a621684ffa47fc008be98b15ff7becaf3a72fa"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.78,6.12.109)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.19,6.18.50)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.253,5.11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.203,5.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.167,6.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.19.9,6.20)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "7.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.109,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.50,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.4,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-12T13:00:12.639565+00:00", "updated": "2026-09-12T17:15:05.230553+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}