Executive brief
A memory management error was identified in the Linux kernel's internal testing suite. This flaw occurs during the cleanup of device nodes, where the system might attempt to access data that has already been deleted. Because this issue is located within the kernel's self-test code (unittest), it primarily impacts developers and automated testing environments rather than production data or general system stability.
Technical details
A use-after-free (UAF) vulnerability exists in drivers/of/unittest.c within the of_unittest_changeset() function. The root cause is a premature call to of_node_put(nchangeset), which decrements the reference count of a device node to zero and frees it while a secondary pointer ('parent') still references the same memory. Subsequent code attempts to read properties from the 'parent' pointer, leading to the UAF. This is a local vulnerability triggered during the execution of kernel unit tests. The fix involves reordering the of_node_put() call to ensure it occurs only after all references to the node are completed.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026
Timeline
- 2026-04-09: disclosed: Initial patch submitted by Wentao Liang
- 2026-06-08: advisory: CVE-2026-46288 published