CVE-2026-64220 Details
Description
In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode->secondary to NULL in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitalized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization.
A vulnerability exists in the Linux kernel's handling of firmware nodes. When a firmware node is created either on the stack or heap using a non-zeroing allocation function and initialized with 'fwnode_init()', the 'secondary' pointer may contain uninitialized memory. This memory could be erroneously dereferenced, potentially leading to undefined behavior. The issue has been addressed by modifying the 'fwnode_init()' function to set the 'secondary' pointer to NULL, preventing the accidental use of invalid memory.
The vulnerability has been fixed in the Linux kernel by updating the 'fwnode_init()' function to initialize the 'secondary' pointer to NULL. Users should upgrade to the latest version of the Linux kernel where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/215c90ee656114f5e8c32408228d97082f8e0eef | kernel.org | Patch |
| https://git.kernel.org/stable/c/34bf74b1fd2e4a44e27821a329204caf09df2976 | kernel.org | Patch |
| https://git.kernel.org/stable/c/371f53925a6714d0aa35f1aefdffc3e8cd62f480 | kernel.org | Patch |
| https://git.kernel.org/stable/c/3f1024deeab3b5443c29b3de4fe475e87309b8fa | kernel.org | Patch |
| https://git.kernel.org/stable/c/508fd8ab158abd04b7f7d0f707cd6d6c405df4ea | kernel.org | Patch |
| https://git.kernel.org/stable/c/f0e211d6539fae800217c10797993b7592d6ab01 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f59e686c778cb41b8f7aa8fab2afd6a01afb3d47 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.142 >= 6.7, < 6.12.92 >= 6.13, < 6.18.34 >= 6.19, < 7.0.11 7.1 rc1 7.1 rc2 7.1 rc3 7.1 rc4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | Initial Analysis | [email protected] |
| Jul 24, 2026 | New CVE Received | kernel.org |