CVE-2026-89744device property: fix infinite loop in fwnode_for_each_child_node()

Description

In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over children of a fwnode that has a secondary fwnode, fwnode_get_next_child_node() can enter an infinite loop if the secondary fwnode has more than one child. Parent Child (Primary fwnode) FWa: {FWa1, FWa2, FWa3} (Secondary fwnode) FWb: {FWb1, FWb2} In this case: ┌─> fwnode_get_next_child_node(FWa, FWa1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2 │ │ ... │ │ fwnode_get_next_child_node(FWa, FWa3) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL │ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1 │ │ fwnode_get_next_child_node(FWa, FWb1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1 └────┘ This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}. The root cause is that when the current child (FWb1) belongs to the secondary fwnode, calling get_next_child_node() on the parimary fwnode incorrectly returns the first child (FWa1) again instead of NULL. Fix this by dynamically checking the parent fwnode of the current child before calling get_next_child_node(). This approach follows the pattern established in commit b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()").

Timeline

Scores

EPSS (exploitation in 30 days)

0.14% · top 96% of all CVEs (15 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.

Affected products

• Linux · Linux

  • affected d1370a4f2aa0d811d419f6a6c6d257867d608956 – < 45a8fc4a12751833ed3868095d18200a85336760
  • affected 5b51b2ba5207e07bcd7be0daab2f8eea405e005e – < 770c9bde93c8bb644f590743e9fbae3492a20f9e
  • affected 272fcf19fda14ec603ce915aafc56cb3ea2fb38d – < 04004fa33730031392d987a9c1bbd8a0e1c4794b
  • affected 3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6 – < f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0
  • affected 64dc258f9eec1d7204e9879cb836fe29967f1239 – < 20ed517e416df89448029293304c9e180c26cd4b
  • affected 32752c3e81498b106da64a141379eb94f493fe6f – < ba69d892ff4e4a58cc12a2cae106b112db3306cc
  • affected 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 – < 9cb6b223ef02cb5c9777a852ae1ecf5796987eb6
  • affected 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 – < 1900692555826753adab8799a1a8d50bb1ee200c
  • affected 43a621684ffa47fc008be98b15ff7becaf3a72fa
  • affected 5.10.253 – < 5.10.273
  • affected 5.15.203 – < 5.15.224
  • affected 6.1.167 – < 6.1.188
  • affected 6.6.130 – < 6.6.157
  • affected 6.12.78 – < 6.12.109
  • affected 6.18.19 – < 6.18.50
  • affected 6.19.9 – < 6.20

• Linux · Linux

  • affected 7.0
  • unaffected < 7.0
  • unaffected 5.10.273 – ≤ 5.10.*
  • unaffected 5.15.224 – ≤ 5.15.*
  • unaffected 6.1.188 – ≤ 6.1.*
  • unaffected 6.6.157 – ≤ 6.6.*
  • unaffected 6.12.109 – ≤ 6.12.*
  • unaffected 6.18.50 – ≤ 6.18.*
  • unaffected 7.2.4 – ≤ 7.2.*
  • unaffected 7.3 – ≤ *

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-76656 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-89744](https://cveledger.app/badge/CVE-2026-89744.svg)](https://cveledger.app/cve/CVE-2026-89744)

Record last updated 30 Oct 2026, 12:32 UTC.