GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89744 (GCVE-0-2026-89744)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:46 – Updated: 2026-09-14 12:02
VLAI
Title
device property: fix infinite loop in fwnode_for_each_child_node()
Summary
In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over children of a fwnode that has a secondary fwnode, fwnode_get_next_child_node() can enter an infinite loop if the secondary fwnode has more than one child. Parent Child (Primary fwnode) FWa: {FWa1, FWa2, FWa3} (Secondary fwnode) FWb: {FWb1, FWb2} In this case: ┌─> fwnode_get_next_child_node(FWa, FWa1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2 │ │ ... │ │ fwnode_get_next_child_node(FWa, FWa3) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL │ - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1 │ │ fwnode_get_next_child_node(FWa, FWb1) │ - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1 └────┘ This cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}. The root cause is that when the current child (FWb1) belongs to the secondary fwnode, calling get_next_child_node() on the parimary fwnode incorrectly returns the first child (FWa1) again instead of NULL. Fix this by dynamically checking the parent fwnode of the current child before calling get_next_child_node(). This approach follows the pattern established in commit b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()").
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 272fcf19fda14ec603ce915aafc56cb3ea2fb38d , < 04004fa33730031392d987a9c1bbd8a0e1c4794b (git)
Affected: 3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6 , < f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0 (git)
Affected: 64dc258f9eec1d7204e9879cb836fe29967f1239 , < 20ed517e416df89448029293304c9e180c26cd4b (git)
Affected: 32752c3e81498b106da64a141379eb94f493fe6f , < ba69d892ff4e4a58cc12a2cae106b112db3306cc (git)
Affected: 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 , < 9cb6b223ef02cb5c9777a852ae1ecf5796987eb6 (git)
Affected: 2692c614f8f05929d692b3dbfd3faef1f00fbaf0 , < 1900692555826753adab8799a1a8d50bb1ee200c (git)
Affected: d1370a4f2aa0d811d419f6a6c6d257867d608956 (git)
Affected: 5b51b2ba5207e07bcd7be0daab2f8eea405e005e (git)
Affected: 43a621684ffa47fc008be98b15ff7becaf3a72fa (git)
Affected: 6.1.167 , < 6.1.188 (semver)
Affected: 6.6.130 , < 6.6.157 (semver)
Affected: 6.12.78 , < 6.12.109 (semver)
Affected: 6.18.19 , < 6.18.50 (semver)
Affected: 5.10.253 , < 5.11 (semver)
Affected: 5.15.203 , < 5.16 (semver)
Affected: 6.19.9 , < 6.20 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/property.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "04004fa33730031392d987a9c1bbd8a0e1c4794b",
              "status": "affected",
              "version": "272fcf19fda14ec603ce915aafc56cb3ea2fb38d",
              "versionType": "git"
            },
            {
              "lessThan": "f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0",
              "status": "affected",
              "version": "3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6",
              "versionType": "git"
            },
            {
              "lessThan": "20ed517e416df89448029293304c9e180c26cd4b",
              "status": "affected",
              "version": "64dc258f9eec1d7204e9879cb836fe29967f1239",
              "versionType": "git"
            },
            {
              "lessThan": "ba69d892ff4e4a58cc12a2cae106b112db3306cc",
              "status": "affected",
              "version": "32752c3e81498b106da64a141379eb94f493fe6f",
              "versionType": "git"
            },
            {
              "lessThan": "9cb6b223ef02cb5c9777a852ae1ecf5796987eb6",
              "status": "affected",
              "version": "2692c614f8f05929d692b3dbfd3faef1f00fbaf0",
              "versionType": "git"
            },
            {
              "lessThan": "1900692555826753adab8799a1a8d50bb1ee200c",
              "status": "affected",
              "version": "2692c614f8f05929d692b3dbfd3faef1f00fbaf0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d1370a4f2aa0d811d419f6a6c6d257867d608956",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5b51b2ba5207e07bcd7be0daab2f8eea405e005e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "43a621684ffa47fc008be98b15ff7becaf3a72fa",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.109",
              "status": "affected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.50",
              "status": "affected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/base/property.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.167",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6.130",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.12.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.18.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.253",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndevice property: fix infinite loop in fwnode_for_each_child_node()\n\nWhen iterate over children of a fwnode that has a secondary fwnode,\nfwnode_get_next_child_node() can enter an infinite loop if the secondary\nfwnode has more than one child.\n\n                       Parent        Child\n      (Primary fwnode)   FWa:   {FWa1, FWa2, FWa3}\n    (Secondary fwnode)   FWb:   {FWb1, FWb2}\n\nIn this case:\n\n \u250c\u2500\u003e fwnode_get_next_child_node(FWa, FWa1)\n \u2502    - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2\n \u2502\n \u2502   ...\n \u2502\n \u2502   fwnode_get_next_child_node(FWa, FWa3)\n \u2502    - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL\n \u2502    - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1\n \u2502\n \u2502   fwnode_get_next_child_node(FWa, FWb1)\n \u2502    - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1\n \u2514\u2500\u2500\u2500\u2500\u2518\n\nThis cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly\noutput {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.\n\nThe root cause is that when the current child (FWb1) belongs to the\nsecondary fwnode, calling get_next_child_node() on the parimary fwnode\nincorrectly returns the first child (FWa1) again instead of NULL.\n\nFix this by dynamically checking the parent fwnode of the current child\nbefore calling get_next_child_node(). This approach follows the pattern\nestablished in commit b5b41ab6b0c1 (\"device property: Check\nfwnode-\u003esecondary in fwnode_graph_get_next_endpoint()\")."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - fwnode_get_next_child_node() is reached from local driver-core fw_devlink and device_for_each_child_node() during device_add/bind/probe (GPIO, LEDs, IIO, MFD, camera), not from network or remote protocol parsing.\nAC:L - On OF platforms whose primary node has children and a secondary software node also has children, of_get_next_available_child() treats a non-OF child as prev=NULL and restarts at the first OF child, so the loop is deterministic with no race or layout dependency.\nPR:N - No capability or credential check exists on this path; fw_devlink_parse_fwtree()/fw_devlink_pickup_dangling_consumers() and driver probe walk mixed primary/secondary children automatically at boot and hotplug bind on phones, embedded boards, and Galileo GPIO.\nUI:N - Firmware-node child walks run inside kernel device registration, fw_devlink, and driver probe without any victim action such as mounting a filesystem or opening a user-supplied file.\nS:U - The hang and firmware-node use-after-free stay inside the host kernel\u0027s device-property/OF layer and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - Crossing from the last OF child into the secondary node makes software_node_get_next_child() put an already-dropped OF node, underflowing its refcount and freeing it while sibling iteration continues, a use-after-free of firmware-node memory.\nI:H - The extra put leaves the last primary child freed but still linked in the OF sibling list; the next of_get_next_available_child() follows that dangling sibling into freed device_node memory, enabling heap-spray write and control-flow hijack.\nA:H - fwnode_for_each_child_node() spins forever in probe/fw_devlink process context, causing a soft lockup or hung task, and the OF-node use-after-free can also oops or panic the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:02:26.764Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/04004fa33730031392d987a9c1bbd8a0e1c4794b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/20ed517e416df89448029293304c9e180c26cd4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba69d892ff4e4a58cc12a2cae106b112db3306cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cb6b223ef02cb5c9777a852ae1ecf5796987eb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/1900692555826753adab8799a1a8d50bb1ee200c"
        }
      ],
      "title": "device property: fix infinite loop in fwnode_for_each_child_node()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89744",
    "datePublished": "2026-09-11T19:46:50.020Z",
    "dateReserved": "2026-09-11T19:38:34.762Z",
    "dateUpdated": "2026-09-14T12:02:26.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89744",
      "date": "2026-09-15",
      "epss": "0.00144",
      "percentile": "0.03995"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89744\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:20:05.113\",\"lastModified\":\"2026-09-14T13:19:23.193\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndevice property: fix infinite loop in fwnode_for_each_child_node()\\n\\nWhen iterate over children of a fwnode that has a secondary fwnode,\\nfwnode_get_next_child_node() can enter an infinite loop if the secondary\\nfwnode has more than one child.\\n\\n                       Parent        Child\\n      (Primary fwnode)   FWa:   {FWa1, FWa2, FWa3}\\n    (Secondary fwnode)   FWb:   {FWb1, FWb2}\\n\\nIn this case:\\n\\n \u250c\u2500\u003e fwnode_get_next_child_node(FWa, FWa1)\\n \u2502    - fwnode_call_ptr_op(FWa, get_next_child_node, FWa1) returns FWa2\\n \u2502\\n \u2502   ...\\n \u2502\\n \u2502   fwnode_get_next_child_node(FWa, FWa3)\\n \u2502    - fwnode_call_ptr_op(FWa, get_next_child_node, FWa3) returns NULL\\n \u2502    - fwnode_call_ptr_op(FWb, get_next_child_node, FWa3) returns FWb1\\n \u2502\\n \u2502   fwnode_get_next_child_node(FWa, FWb1)\\n \u2502    - fwnode_call_ptr_op(FWa, get_next_child_node, FWb1) returns FWa1\\n \u2514\u2500\u2500\u2500\u2500\u2518\\n\\nThis cause fwnode_for_each_child_node() to loop indefinitely, reapeatedly\\noutput {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.\\n\\nThe root cause is that when the current child (FWb1) belongs to the\\nsecondary fwnode, calling get_next_child_node() on the parimary fwnode\\nincorrectly returns the first child (FWa1) again instead of NULL.\\n\\nFix this by dynamically checking the parent fwnode of the current child\\nbefore calling get_next_child_node(). This approach follows the pattern\\nestablished in commit b5b41ab6b0c1 (\\\"device property: Check\\nfwnode-\u003esecondary in fwnode_graph_get_next_endpoint()\\\").\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/base/property.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"272fcf19fda14ec603ce915aafc56cb3ea2fb38d\",\"lessThan\":\"04004fa33730031392d987a9c1bbd8a0e1c4794b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3cfdf8d27b668d122a67a14bf2bcde1a7f10bbd6\",\"lessThan\":\"f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"64dc258f9eec1d7204e9879cb836fe29967f1239\",\"lessThan\":\"20ed517e416df89448029293304c9e180c26cd4b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"32752c3e81498b106da64a141379eb94f493fe6f\",\"lessThan\":\"ba69d892ff4e4a58cc12a2cae106b112db3306cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2692c614f8f05929d692b3dbfd3faef1f00fbaf0\",\"lessThan\":\"9cb6b223ef02cb5c9777a852ae1ecf5796987eb6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2692c614f8f05929d692b3dbfd3faef1f00fbaf0\",\"lessThan\":\"1900692555826753adab8799a1a8d50bb1ee200c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d1370a4f2aa0d811d419f6a6c6d257867d608956\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5b51b2ba5207e07bcd7be0daab2f8eea405e005e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43a621684ffa47fc008be98b15ff7becaf3a72fa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.167\",\"lessThan\":\"6.1.188\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.130\",\"lessThan\":\"6.6.157\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.12.78\",\"lessThan\":\"6.12.109\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.18.19\",\"lessThan\":\"6.18.50\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.10.253\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.203\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.19.9\",\"lessThan\":\"6.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/base/property.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.5,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04004fa33730031392d987a9c1bbd8a0e1c4794b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1900692555826753adab8799a1a8d50bb1ee200c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/20ed517e416df89448029293304c9e180c26cd4b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9cb6b223ef02cb5c9777a852ae1ecf5796987eb6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ba69d892ff4e4a58cc12a2cae106b112db3306cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f4ae79b5f00130aacaddb1f3eb2e5ef711fbf9e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:48:05+00:00",
      "cve": "CVE-2026-89744",
      "id": "CVE-2026-89744",
      "initial_release_date": "2026-09-11T19:46:50.020000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service due to infinite loop in device property handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89744.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.