Cloudanix VulnDB

CVE-2026-89744

High · 8.4

CVSS

8.4

EPSS

0.1%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Linux kernel can make the system loop forever when reading certain hardware descriptions, potentially freezing the machine until it is restarted.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Causes an infinite loop in fwnode_for_each_child_node when a primary fwnode has a secondary fwnode with multiple children; get_next_child_node incorrectly returns the first primary child instead of NULL after exhausting secondary children, repeatedly cycling through the node list.

Why it matters to the business

Can freeze device enumeration and related kernel operations on Linux systems, leading to hangs, high CPU usage, or denial of service that disrupts servers, embedded devices, or any workload relying on firmware node iteration.

How an attack unfolds

An attacker with local access supplies or triggers device/firmware node structures containing a secondary fwnode with more than one child; invocation of the iteration helper then enters the loop, exhausting CPU and preventing further progress.

How to fix it

Apply the upstream kernel fix that dynamically checks the parent fwnode of the current child before invoking get_next_child_node on the primary fwnode; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Inspect the device property source for the added parent-fwnode check matching the pattern from commit b5b41ab6b0c1; construct test fwnodes with secondary nodes containing multiple children and confirm iteration terminates after one pass.

Typical attack path

  1. Obtain local execution on the target Linux system
  2. Load or expose a device configuration whose fwnode tree includes a secondary node with multiple children
  3. Trigger fwnode_for_each_child_node or equivalent iteration
  4. Induce repeated cycling that consumes CPU and blocks callers

How to detect it

Search kernel logs and traces for repeated calls to get_next_child_node or fwnode iteration functions without termination; look for processes stuck in uninterruptible sleep during device enumeration.

What your security team should do

  • Expedite deployment of the corrected kernel on all Linux hosts that perform device-property or firmware-node walks
  • Audit workloads that enumerate children of fwnodes with secondary attachments
  • Monitor kernel CPU usage and hung-task reports during device initialization

The record

In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over children of a fwnode that has a secondary fwnode, fwnode_get_next_child_node() can enter an infinite loop if the secondary fwnode has more than one child. Parent Child (Primary fwnode) FWa: {FWa1, FWa2, FWa3} (Secondary fwnode) FWb: {FWb1, FWb2} In this case: ┌─> fwnode_get_next_child_node(FWa, FWa1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2 │ │ ... │ │ fwnode_get_next_child_node(FWa, FWa3) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL │ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1 │ │ fwnode_get_next_child_node(FWa, FWb1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1 └────┘ This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}. The root cause is that when the current child (FWb1) belongs to the secondary fwnode, calling get_next_child_node() on the parimary fwnode incorrectly returns the first child (FWa1) again instead of NULL. Fix this by dynamically checking the parent fwnode of the current child before calling get_next_child_node(). This approach follows the pattern established in commit b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()").

Affected packages

Ecosystem Package Introduced Fixed