Executive brief
The Linux kernel's device property handling contains a logic error that causes infinite loops when iterating over device firmware nodes that have both primary and secondary configurations. This can cause system processes to hang indefinitely, leading to service degradation or denial of service on affected systems.
Technical details
The vulnerability exists in the fwnode_get_next_child_node() function in drivers/base/property.c. When iterating over child firmware nodes where a parent has both a primary and secondary fwnode, the function can enter an infinite loop if the secondary fwnode contains multiple children. The root cause is that after exhausting primary children and moving to secondary children, the function incorrectly calls get_next_child_node() on the primary fwnode with a secondary child as the parameter, causing it to wrap around to the first primary child again. The fix dynamically checks the actual parent of the current child before calling get_next_child_node(), ensuring proper parent context is maintained. This is a local, in-kernel logic error with no network attack vector required; any code path that uses fwnode_for_each_child_node() macro can trigger the loop.
Affected products
- Linux Linux kernel affected versions prior to patch commit 1900692555826753adab8799a1a8d50bb1ee200c (introduced in 2692c614f8f0)
Timeline
- 2026-09-11: disclosed: Published via NVD
- 2026-09-14: patched: Patch merged by Greg Kroah-Hartman
- 2026-06-11: other: Fix authored by Xu Yang