Junglewise Threat Intelligence

CVE-2026-45989: Linux Kernel use-after-free in of: unittest testdrv_probe

CVE-2026-45989 · Severity: info · CVSS 0 · Published 2026-05-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's device tree unit testing component. This flaw could lead to a system crash or unpredictable behavior when the kernel performs specific hardware testing routines. Because this issue is located within a testing module, the risk to standard production operations is generally low.

Technical details

A use-after-free vulnerability exists in the testdrv_probe() function within drivers/of/unittest.c. The function incorrectly calls of_node_put() on a device_node pointer ('dn') retrieved from a PCI device, which releases a reference owned by the device model. When the freed pointer is subsequently passed to of_platform_default_populate(), it triggers a use-after-free condition. This issue is resolved by removing the erroneous of_node_put() call to ensure the reference count remains valid. The vulnerability is primarily reachable during the execution of kernel unit tests.

Affected products

  • Linux Linux Kernel Fixed in 07fd339b2c253205794bea5d9b4b7548a4546c56 and related stable branches

Timeline

  • 2026-04-09: disclosed: Initial patch submitted by Wentao Liang
  • 2026-05-27: advisory: CVE-2026-45989 published by NVD

References

Related threats