{"id":"CVE-2026-89744","summary":"device property: fix infinite loop in fwnode_for_each_child_node()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndevice property: fix infinite loop in fwnode_for_each_child_node()\n\nWhen iterate over children of a fwnode that has a secondary fwnode,\nfwnode_get_next_child_node() can enter an infinite loop if the secondary\nfwnode has more than one child.\n\n                       Parent        Child\n      (Primary fwnode)   FWa:   {FWa1, FWa2, FWa3}\n    (Secondary fwnode)   FWb:   {FWb1, FWb2}\n\nIn this case:\n\n ┌─\u003e fwnode_get_next_child_node(FWa, FWa1)\n │    - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2\n │\n │   ...\n │\n │   fwnode_get_next_child_node(FWa, FWa3)\n │    - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL\n │    - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1\n │\n │   fwnode_get_next_child_node(FWa, FWb1)\n │    - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1\n └────┘\n\nThis cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly\noutput {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.\n\nThe root cause is that when the current child (FWb1) belongs to the\nsecondary fwnode, calling get_next_child_node() on the parimary fwnode\nincorrectly returns the first child (FWa1) again instead of NULL.\n\nFix this by dynamically checking the parent fwnode of the current child\nbefore calling get_next_child_node(). This approach follows the pattern\nestablished in commit b5b41ab6b0c1 (\"device property: Check\nfwnode-\u003esecondary in fwnode_graph_get_next_endpoint()\").","modified":"2026-11-13T04:07:03.681703604Z","published":"2026-09-11T19:46:50.020Z","related":["SUSE-SU-2026:24550-1","SUSE-SU-2026:24619-1","SUSE-SU-2026:24643-1","SUSE-SU-2026:24648-1","SUSE-SU-2026:24651-1","SUSE-SU-2026:24662-1","SUSE-SU-2026:5091-1","openSUSE-SU-2026:11880-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89744.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/04004fa33730031392d987a9c1bbd8a0e1c4794b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1900692555826753adab8799a1a8d50bb1ee200c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/20ed517e416df89448029293304c9e180c26cd4b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/45a8fc4a12751833ed3868095d18200a85336760"},{"type":"WEB","url":"https://git.kernel.org/stable/c/770c9bde93c8bb644f590743e9fbae3492a20f9e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9cb6b223ef02cb5c9777a852ae1ecf5796987eb6"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ba69d892ff4e4a58cc12a2cae106b112db3306cc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89744.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89744"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"d1370a4f2aa0d811d419f6a6c6d257867d608956"},{"fixed":"45a8fc4a12751833ed3868095d18200a85336760"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5b51b2ba5207e07bcd7be0daab2f8eea405e005e"},{"fixed":"770c9bde93c8bb644f590743e9fbae3492a20f9e"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"272fcf19fda14ec603ce915aafc56cb3ea2fb38d"},{"fixed":"04004fa33730031392d987a9c1bbd8a0e1c4794b"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6"},{"fixed":"f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"64dc258f9eec1d7204e9879cb836fe29967f1239"},{"fixed":"20ed517e416df89448029293304c9e180c26cd4b"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"32752c3e81498b106da64a141379eb94f493fe6f"},{"fixed":"ba69d892ff4e4a58cc12a2cae106b112db3306cc"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2692c614f8f05929d692b3dbfd3faef1f00fbaf0"},{"fixed":"9cb6b223ef02cb5c9777a852ae1ecf5796987eb6"},{"fixed":"1900692555826753adab8799a1a8d50bb1ee200c"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"43a621684ffa47fc008be98b15ff7becaf3a72fa"}]}],"versions":["v5.10.272","v5.10.271","v5.10.270","v5.10.269","v5.10.268","v5.10.267","v5.10.266","v5.10.265","v5.10.264","v5.10.263","v5.10.262","v5.10.261","v5.10.260","v5.10.259","v5.10.258","v5.10.257","v5.10.256","v5.10.255","v5.10.254","v5.10.253","v5.15.223","v5.15.222","v5.15.221","v5.15.220","v5.15.219","v5.15.218","v5.15.217","v5.15.216","v5.15.215","v5.15.214","v5.15.213","v5.15.212","v5.15.211","v5.15.210","v5.15.209","v5.15.208","v5.15.207","v5.15.206","v5.15.205","v5.15.204","v5.15.203","v6.1.187","v6.1.186","v6.1.185","v6.1.184","v6.1.183","v6.1.182","v6.1.181","v6.1.180","v6.1.179","v6.1.178","v6.1.177","v6.1.176","v6.1.175","v6.1.174","v6.1.173","v6.1.172","v6.1.171","v6.1.170","v6.1.169","v6.1.168","v6.1.167","v6.6.156","v6.6.155","v6.6.154","v6.6.153","v6.6.152","v6.6.151","v6.6.150","v6.6.149","v6.6.148","v6.6.147","v6.6.146","v6.6.145","v6.6.144","v6.6.143","v6.6.142","v6.6.141","v6.6.140","v6.6.139","v6.6.138","v6.6.137","v6.6.136","v6.6.135","v6.6.134","v6.6.133","v6.6.132","v6.6.131","v6.6.130","v6.12.108","v6.12.107","v6.12.106","v6.12.105","v6.12.104","v6.12.103","v6.12.102","v6.12.101","v6.12.100","v6.12.99","v6.12.98","v6.12.97","v6.12.96","v6.12.95","v6.12.94","v6.12.93","v6.12.92","v6.12.91","v6.12.90","v6.12.89","v6.12.88","v6.12.87","v6.12.86","v6.12.85","v6.12.84","v6.12.83","v6.12.82","v6.12.81","v6.12.80","v6.12.79","v6.12.78","v6.18.49","v6.18.48","v6.18.47","v6.18.46","v6.18.45","v6.18.44","v6.18.43","v6.18.42","v6.18.41","v6.18.40","v6.18.39","v6.18.38","v6.18.37","v6.18.36","v6.18.35","v6.18.34","v6.18.33","v6.18.32","v6.18.31","v6.18.30","v6.18.29","v6.18.28","v6.18.27","v6.18.26","v6.18.25","v6.18.24","v6.18.23","v6.18.22","v6.18.21","v6.18.20","v6.18.19","v6.19.14","v6.19.13","v6.19.12","v6.19.11","v6.19.10","v6.19.9"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89744.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.10.253"},{"fixed":"5.10.273"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.15.203"},{"fixed":"5.15.224"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.1.167"},{"fixed":"6.1.188"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.6.130"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.12.78"},{"fixed":"6.12.109"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.18.19"},{"fixed":"6.18.50"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.9"},{"fixed":"6.20"}]},{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-89744.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}