Executive brief
A vulnerability was identified in the Linux kernel's FPGA (Field Programmable Gate Array) region management component. The issue occurs when the system attempts to log an error message after already releasing the memory associated with a specific device node, potentially leading to a system crash or unpredictable behavior. This affects systems using FPGA hardware with Device Tree control.
Technical details
A use-after-free vulnerability exists in drivers/fpga/of-fpga-region.c within the child_regions_with_firmware() function. The root cause is the premature invocation of of_node_put(child_region) before a pr_err() call that references the same child_region pointer. An attacker with the ability to trigger specific FPGA reconfiguration error paths could potentially exploit this memory corruption. The fix involves reordering the code to ensure the reference count is only decremented after all logging references to the node are complete. Patches have been merged into multiple stable kernel branches including 5.10.y, 5.15.y, 6.1.y, and 6.6.y.
Affected products
- Linux Linux 4.10 to 5.10.260, 5.15.211, 6.1.177, 6.6.144
Timeline
- 2026-07-24: disclosed
- 2026-07-24: advisory
References
- https://git.kernel.org/stable/c/070b0ce947b18fa3dec0729695147f7e19599649
- https://git.kernel.org/stable/c/369496d885b4cf6e8647cf4dc5cf3ac68fdf37a1
- https://git.kernel.org/stable/c/54f3c5643ec523a04b6ec0e7c19eb10f5ebebdd3
- https://git.kernel.org/stable/c/5e098e40e8bac43ed58645c10d5fad781966efe4
- https://git.kernel.org/stable/c/866184fc7ae42a0070f1141ae8c5dca7c24a59e2
- https://git.kernel.org/stable/c/e79afcb0a66d2b3c33e510eade902537e656fc00
- https://git.kernel.org/stable/c/e918942bcc5355ad5b44ba557935dffc0727b0eb