Executive brief
The Linux kernel's software node reference handling function had a flawed bounds check that could be bypassed when an invalid index (UINT_MAX) was passed, potentially allowing out-of-bounds memory access. This could lead to information disclosure or system instability on systems using the affected kernel code path.
Technical details
The vulnerability is a bounds check bypass in the software_node_get_reference_args() function in drivers/base/swnode.c. The original check `(index + 1) * sizeof(*ref) > prop->length` fails to correctly validate the UINT_MAX index value due to integer overflow, allowing an attacker to pass an out-of-bounds index that bypasses the check and accesses beyond the allocated property array. The fix changes the bounds check to `index >= prop->length / sizeof(*ref)`, which correctly prevents out-of-bounds access. The attack vector requires the ability to call this function with a malicious index parameter, typically through device tree or firmware node initialization on systems using software nodes.
Affected products
- Linux Linux kernel Multiple versions (see stable tree references)
Timeline
- 2026-09-17: disclosed
- 2026-06-11: patched