device property: fix infinite loop in fwnode_for_each_child_node() (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.14 % · centile 3 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Received
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over children of a fwnode that has a secondary fwnode, fwnode_get_next_child_node() can enter an infinite loop if the secondary fwnode has more than one child. Parent Child (Primary fwnode) FWa: {FWa1, FWa2, FWa3} (Secondary fwnode) FWb: {FWb1, FWb2} In this case: ┌─> fwnode_get_next_child_node(FWa, FWa1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2 │ │ ... │ │ fwnode_get_next_child_node(FWa, FWa3) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL │ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1 │ │ fwnode_get_next_child_node(FWa, FWb1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1 └────┘ This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}. The root cause is that when the current child (FWb1) belongs to the secondary fwnode, calling get_next_child_node() on the parimary fwnode incorrectly returns the first child (FWa1) again instead of NULL. Fix this by dynamically checking the parent fwnode of the current child before calling get_next_child_node(). This approach follows the pattern established in commit b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()").
Références
- https://git.kernel.org/stable/c/45a8fc4a12751833ed3868095d18200a85336760
- https://git.kernel.org/stable/c/770c9bde93c8bb644f590743e9fbae3492a20f9e
- https://git.kernel.org/stable/c/04004fa33730031392d987a9c1bbd8a0e1c4794b
- https://git.kernel.org/stable/c/f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0
- https://git.kernel.org/stable/c/20ed517e416df89448029293304c9e180c26cd4b
- https://git.kernel.org/stable/c/ba69d892ff4e4a58cc12a2cae106b112db3306cc
- https://git.kernel.org/stable/c/9cb6b223ef02cb5c9777a852ae1ecf5796987eb6
- https://git.kernel.org/stable/c/1900692555826753adab8799a1a8d50bb1ee200c
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-76656
- GCVE · GCVE-0-2026-89744
Avis du CERT-FR
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected d1370a4f2aa0d811d419f6a6c6d257867d608956 < 45a8fc4a12751833ed3868095d18200a85336760 ; affected 5b51b2ba5207e07bcd7be0daab2f8eea405e005e < 770c9bde93c8bb644f590743e9fbae3492a20f9e ; affected 272fcf19fda14ec603ce915aafc56cb3ea2fb38d < 04004fa33730031392d987a9c1bbd8a0e1c4794b ; affected 3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6 < f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0 ; affected 64dc258f9eec1d7204e9879cb836fe29967f1239 < 20ed517e416df89448029293304c9e180c26cd4b ; affected 32752c3e81498b106da64a141379eb94f493fe6f < ba69d892ff4e4a58cc12a2cae106b112db3306cc |
| Linux · Linux | affected 7.0 ; unaffected 0 < 7.0 ; unaffected 5.10.273 ≤ 5.10.* ; unaffected 5.15.224 ≤ 5.15.* ; unaffected 6.1.188 ≤ 6.1.* ; unaffected 6.6.157 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |