Executive brief
A vulnerability was identified in the Linux kernel's device tree unit testing component. This flaw could lead to a system crash or unpredictable behavior when the kernel performs specific hardware testing routines. Because this issue is located within a testing module, the risk to standard production operations is generally low.
Technical details
A use-after-free vulnerability exists in the testdrv_probe() function within drivers/of/unittest.c. The function incorrectly calls of_node_put() on a device_node pointer ('dn') retrieved from a PCI device, which releases a reference owned by the device model. When the freed pointer is subsequently passed to of_platform_default_populate(), it triggers a use-after-free condition. This issue is resolved by removing the erroneous of_node_put() call to ensure the reference count remains valid. The vulnerability is primarily reachable during the execution of kernel unit tests.
Affected products
- Linux Linux Kernel Fixed in 07fd339b2c253205794bea5d9b4b7548a4546c56 and related stable branches
Timeline
- 2026-04-09: disclosed: Initial patch submitted by Wentao Liang
- 2026-05-27: advisory: CVE-2026-45989 published by NVD
References
- https://git.kernel.org/stable/c/07fd339b2c253205794bea5d9b4b7548a4546c56
- https://git.kernel.org/stable/c/0ba03e06f037df704d9b032e36d417633e2326bc
- https://git.kernel.org/stable/c/5b6122a67a295f8a08b7c18d908a1bd974dfaec8
- https://git.kernel.org/stable/c/6b2023286d2c6ed3bf964fb92e34c9c14d42eb69
- https://git.kernel.org/stable/c/d68347b07b9801791c9eaab8f772770b52b8cd5c