From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 526F75947F1 for ; Fri, 11 Sep 2026 20:07:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789157229; cv=none; b=qS/pGlZGEIzUbhVKJbIU39age2PbVcqCcxMGWDluOrcGOkDIqBYCN8PF1B64PD5RtkHtPvxqWk8xnqn074VEFYM5/lw6gXxtsQn+N/yqIPnri+9vuZTGuEejHL/agFFotcAJdogjGYbC+2qGqZzXWfVk51uit31gvAW5Qb2DgL4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789157229; c=relaxed/simple; bh=ezet8L2DAkgRcByVv6uaR6wOKmbpmdgpiHtVTW8yvYw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=Gvwjnc2mSAjE/gHNn/HorSq/RuS1xMT0ZDmwUUZz6LTAgNHOba2mZjQl/YLufw4j7kWE8uGJ36WDzis1xiSi3BNYvoEKUQHTCB4Ja/IXJYJ4hoSUhGdmvntBe0Z3TE1Wf0De87hNaEwQateY+E9DG2a5duktUyfLhEptPojPefE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TXpR+Dkc; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="TXpR+Dkc" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 092701F00893; Fri, 11 Sep 2026 20:07:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789157225; bh=l5wOQuBzWbZjzlQV4Gguu6c+G1DIXhnvEwDGPxvrbxI=; h=From:To:Cc:Subject:Date:Reply-To; b=TXpR+DkcnIWT5qpwibM+HVlBx8UxXj0gWeA1yDOiEUzAMjP34Pn7EpS7p6Uj46iX1 ux4qjCZ8JwjeIV3Svhrc0er5qfwMY6Jlh/39aZq0OArEm/4niCwl3+nQ5Pap1TdEkK sGxR5hn8rnIeWQMRGcHlbOX0hfZuz+xavG8OpeLA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89744: device property: fix infinite loop in fwnode_for_each_child_node() Date: Fri, 11 Sep 2026 21:47:13 +0200 Message-ID: <2026091105-CVE-2026-89744-c17f@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4081; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=1FGjhp1k6R6fq7znpO/KH3LzBqUIK7lDYLfyh6eGVPc=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLInvvr7nBfuV/TohnYv/KSV8Uq27N6T5c88N7+tVpF 34ZfL79oSOWhUGQiUFWTJHlyzaeo/srDil6GdqehpnDygQyhIGLUwAm4r6dYcEFLb6lm+tMd8TF l5WKp7L/eFz3/QHDgg2LXX58+7ZmP9vK6pfLnvumHDfJSgcA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over children of a fwnode that has a secondary fwnode, fwnode_get_next_child_node() can enter an infinite loop if the secondary fwnode has more than one child. Parent Child (Primary fwnode) FWa: {FWa1, FWa2, FWa3} (Secondary fwnode) FWb: {FWb1, FWb2} In this case: ┌─> fwnode_get_next_child_node(FWa, FWa1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2 │ │ ... │ │ fwnode_get_next_child_node(FWa, FWa3) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL │ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1 │ │ fwnode_get_next_child_node(FWa, FWb1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1 └────┘ This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}. The root cause is that when the current child (FWb1) belongs to the secondary fwnode, calling get_next_child_node() on the parimary fwnode incorrectly returns the first child (FWa1) again instead of NULL. Fix this by dynamically checking the parent fwnode of the current child before calling get_next_child_node(). This approach follows the pattern established in commit b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()"). The Linux kernel CVE team has assigned CVE-2026-89744 to this issue. Affected and fixed versions =========================== Issue introduced in 6.12.78 with commit 64dc258f9eec1d7204e9879cb836fe29967f1239 and fixed in 6.12.109 with commit 20ed517e416df89448029293304c9e180c26cd4b Issue introduced in 6.18.19 with commit 32752c3e81498b106da64a141379eb94f493fe6f and fixed in 6.18.50 with commit ba69d892ff4e4a58cc12a2cae106b112db3306cc Issue introduced in 7.0 with commit 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 and fixed in 7.2.4 with commit 9cb6b223ef02cb5c9777a852ae1ecf5796987eb6 Issue introduced in 7.0 with commit 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 and fixed in 7.3-rc1 with commit 1900692555826753adab8799a1a8d50bb1ee200c Issue introduced in 5.10.253 with commit d1370a4f2aa0d811d419f6a6c6d257867d608956 Issue introduced in 5.15.203 with commit 5b51b2ba5207e07bcd7be0daab2f8eea405e005e Issue introduced in 6.1.167 with commit 272fcf19fda14ec603ce915aafc56cb3ea2fb38d Issue introduced in 6.6.130 with commit 3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6 Issue introduced in 6.19.9 with commit 43a621684ffa47fc008be98b15ff7becaf3a72fa Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89744 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/base/property.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/20ed517e416df89448029293304c9e180c26cd4b https://git.kernel.org/stable/c/ba69d892ff4e4a58cc12a2cae106b112db3306cc https://git.kernel.org/stable/c/9cb6b223ef02cb5c9777a852ae1ecf5796987eb6 https://git.kernel.org/stable/c/1900692555826753adab8799a1a8d50bb1ee200c