Heimdall Security Logo

CVE-2026-89744

Vulnérabilité élevée dans Linux (Linux)

CVSS 8.4 · Élevée
EPSS 0.1%
Linux•Linux•Versions : 43a621684ffa47fc008be98b15ff7becaf3a72fa, <6.6.157, <5.11, <=6.1.*, <=6.12.*, 3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6, 6.12.78, 2692c614f8f05929d692b3dbfd3faef1f00fbaf0, <6.12.109, 0, <04004fa33730031392d987a9c1bbd8a0e1c4794b, 7.0, 7.2.4, <1900692555826753adab8799a1a8d50bb1ee200c, 6.1.188, <ba69d892ff4e4a58cc12a2cae106b112db3306cc, 6.18.19, <=6.6.*, 6.6.157, <7.0, <20ed517e416df89448029293304c9e180c26cd4b, 5.15.203, <9cb6b223ef02cb5c9777a852ae1ecf5796987eb6, <6.20, 6.19.9, <5.16, <=6.18.*, 32752c3e81498b106da64a141379eb94f493fe6f, 6.1.167, 272fcf19fda14ec603ce915aafc56cb3ea2fb38d, <=7.2.*, <f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0, <=*, d1370a4f2aa0d811d419f6a6c6d257867d608956, 5.10.253, <6.18.50, 64dc258f9eec1d7204e9879cb836fe29967f1239, 6.18.50, 6.6.130, <6.1.188, 6.12.109, 5b51b2ba5207e07bcd7be0daab2f8eea405e005e, 7.3

Description

In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over children of a fwnode that has a secondary fwnode, fwnode_get_next_child_node() can enter an infinite loop if the secondary fwnode has more than one child. Parent Child (Primary fwnode) FWa: {FWa1, FWa2, FWa3} (Secondary fwnode) FWb: {FWb1, FWb2} In this case: ┌─> fwnode_get_next_child_node(FWa, FWa1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2 │ │ ... │ │ fwnode_get_next_child_node(FWa, FWa3) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL │ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1 │ │ fwnode_get_next_child_node(FWa, FWb1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1 └────┘ This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}. The root cause is that when the current child (FWb1) belongs to the secondary fwnode, calling get_next_child_node() on the parimary fwnode incorrectly returns the first child (FWa1) again instead of NULL. Fix this by dynamically checking the parent fwnode of the current child before calling get_next_child_node(). This approach follows the pattern established in commit b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()").

Gravité et risque d'exploitation

CVE-2026-89744 obtient un score CVSS de 8.4/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.14 %, ce qui la place devant 3.1 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions 43a621684ffa47fc008be98b15ff7becaf3a72fa, <6.6.157, <5.11, <=6.1.*, <=6.12.*, 3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6, 6.12.78, 2692c614f8f05929d692b3dbfd3faef1f00fbaf0, <6.12.109, 0, <04004fa33730031392d987a9c1bbd8a0e1c4794b, 7.0, 7.2.4, <1900692555826753adab8799a1a8d50bb1ee200c, 6.1.188, <ba69d892ff4e4a58cc12a2cae106b112db3306cc, 6.18.19, <=6.6.*, 6.6.157, <7.0, <20ed517e416df89448029293304c9e180c26cd4b, 5.15.203, <9cb6b223ef02cb5c9777a852ae1ecf5796987eb6, <6.20, 6.19.9, <5.16, <=6.18.*, 32752c3e81498b106da64a141379eb94f493fe6f, 6.1.167, 272fcf19fda14ec603ce915aafc56cb3ea2fb38d, <=7.2.*, <f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0, <=*, d1370a4f2aa0d811d419f6a6c6d257867d608956, 5.10.253, <6.18.50, 64dc258f9eec1d7204e9879cb836fe29967f1239, 6.18.50, 6.6.130, <6.1.188, 6.12.109, 5b51b2ba5207e07bcd7be0daab2f8eea405e005e, 7.3) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE