{"id":"CVE-2026-89744","title":"device property: fix infinite loop in fwnode_for_each_child_node()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndevice property: fix infinite loop in fwnode_for_each_child_node()\n\nWhen iterate over children of a fwnode that has a secondary fwnode,\nfwnode_get_next_child_node() can…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-835"],"vendor":"Linux","product":"Linux","affected":["Linux >= 272fcf19fda14ec603ce915aafc56cb3ea2fb38d < 04004fa33730031392d987a9c1bbd8a0e1c4794b","Linux >= 3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6 < f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0","Linux >= 64dc258f9eec1d7204e9879cb836fe29967f1239 < 20ed517e416df89448029293304c9e180c26cd4b","Linux >= 32752c3e81498b106da64a141379eb94f493fe6f < ba69d892ff4e4a58cc12a2cae106b112db3306cc","Linux >= 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 < 9cb6b223ef02cb5c9777a852ae1ecf5796987eb6","Linux >= 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 < 1900692555826753adab8799a1a8d50bb1ee200c","Linux d1370a4f2aa0d811d419f6a6c6d257867d608956","Linux 5b51b2ba5207e07bcd7be0daab2f8eea405e005e","Linux 43a621684ffa47fc008be98b15ff7becaf3a72fa","Linux >= 6.1.167 < 6.1.188","Linux >= 6.6.130 < 6.6.157","Linux >= 6.12.78 < 6.12.109","Linux >= 6.18.19 < 6.18.50","Linux >= 5.10.253 < 5.11","Linux >= 5.15.203 < 5.16","Linux >= 6.19.9 < 6.20","Linux 7.0"],"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:51:58.192Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89744","references":[{"url":"https://git.kernel.org/stable/c/04004fa33730031392d987a9c1bbd8a0e1c4794b"},{"url":"https://git.kernel.org/stable/c/f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0"},{"url":"https://git.kernel.org/stable/c/20ed517e416df89448029293304c9e180c26cd4b"},{"url":"https://git.kernel.org/stable/c/ba69d892ff4e4a58cc12a2cae106b112db3306cc"},{"url":"https://git.kernel.org/stable/c/9cb6b223ef02cb5c9777a852ae1ecf5796987eb6"},{"url":"https://git.kernel.org/stable/c/1900692555826753adab8799a1a8d50bb1ee200c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89744.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89744"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532312"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89744"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89744"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89744.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00142,"epssPercentile":0.0345,"scores":{"cna":8.4,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.449Z","slug":"CVE-2026-89744","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndevice property: fix infinite loop in fwnode_for_each_child_node()\n\nWhen iterate over children of a fwnode that has a secondary fwnode,\nfwnode_get_next_child_node() can enter an infinite loop if the secondary\nfwnode has more than one child.\n\n                       Parent        Child\n      (Primary fwnode)   FWa:   {FWa1, FWa2, FWa3}\n    (Secondary fwnode)   FWb:   {FWb1, FWb2}\n\nIn this case:\n\n ┌─> fwnode_get_next_child_node(FWa, FWa1)\n │    - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2\n │\n │   ...\n │\n │   fwnode_get_next_child_node(FWa, FWa3)\n │    - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL\n │    - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1\n │\n │   fwnode_get_next_child_node(FWa, FWb1)\n │    - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1\n └────┘\n\nThis cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly\noutput {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.\n\nThe root cause is that when the current child (FWb1) belongs to the\nsecondary fwnode, calling get_next_child_node() on the parimary fwnode\nincorrectly returns the first child (FWa1) again instead of NULL.\n\nFix this by dynamically checking the parent fwnode of the current child\nbefore calling get_next_child_node(). This approach follows the pattern\nestablished in commit b5b41ab6b0c1 (\"device property: Check\nfwnode->secondary in fwnode_graph_get_next_endpoint()\").\n\n## Affected\n\n- `Linux >= 272fcf19fda14ec603ce915aafc56cb3ea2fb38d < 04004fa33730031392d987a9c1bbd8a0e1c4794b`\n- `Linux >= 3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6 < f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0`\n- `Linux >= 64dc258f9eec1d7204e9879cb836fe29967f1239 < 20ed517e416df89448029293304c9e180c26cd4b`\n- `Linux >= 32752c3e81498b106da64a141379eb94f493fe6f < ba69d892ff4e4a58cc12a2cae106b112db3306cc`\n- `Linux >= 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 < 9cb6b223ef02cb5c9777a852ae1ecf5796987eb6`\n- `Linux >= 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 < 1900692555826753adab8799a1a8d50bb1ee200c`\n- `Linux d1370a4f2aa0d811d419f6a6c6d257867d608956`\n- `Linux 5b51b2ba5207e07bcd7be0daab2f8eea405e005e`\n- `Linux 43a621684ffa47fc008be98b15ff7becaf3a72fa`\n- `Linux >= 6.1.167 < 6.1.188`\n- `Linux >= 6.6.130 < 6.6.157`\n- `Linux >= 6.12.78 < 6.12.109`\n- `Linux >= 6.18.19 < 6.18.50`\n- `Linux >= 5.10.253 < 5.11`\n- `Linux >= 5.15.203 < 5.16`\n- `Linux >= 6.19.9 < 6.20`\n- `Linux 7.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89744.json)","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":224580,"id":"CVE-2026-89744","ts":1792401419176,"field":"cvss","old":"5.5","new":"8.4"},{"seq":224579,"id":"CVE-2026-89744","ts":1792401419176,"field":"severity","old":"medium","new":"high"},{"seq":205470,"id":"CVE-2026-89744","ts":1789576721365,"field":"cvss","old":"8.4","new":"5.5"},{"seq":205469,"id":"CVE-2026-89744","ts":1789576721365,"field":"severity","old":"high","new":"medium"},{"seq":197676,"id":"CVE-2026-89744","ts":1789384318350,"field":"cvss","old":"4.4","new":"8.4"},{"seq":197675,"id":"CVE-2026-89744","ts":1789384318350,"field":"severity","old":"medium","new":"high"},{"seq":183827,"id":"CVE-2026-89744","ts":1789356677574,"field":"cvss","old":"8.4","new":"4.4"},{"seq":183826,"id":"CVE-2026-89744","ts":1789356677574,"field":"severity","old":"high","new":"medium"},{"seq":153630,"id":"CVE-2026-89744","ts":1789285351627,"field":"cvss","old":null,"new":"8.4"},{"seq":153629,"id":"CVE-2026-89744","ts":1789285351627,"field":"severity","old":"none","new":"high"},{"seq":147377,"id":"CVE-2026-89744","ts":1789270210665,"field":"cvss","old":null,"new":"4.4"},{"seq":147376,"id":"CVE-2026-89744","ts":1789270210665,"field":"severity","old":"none","new":"medium"},{"seq":109129,"id":"CVE-2026-89744","ts":1789183730423,"field":"cvss","old":null,"new":"4.4"},{"seq":109128,"id":"CVE-2026-89744","ts":1789183730423,"field":"severity","old":"none","new":"medium"}]}