In the Linux kernel, the following vulnerability has been resolved:
of: unittest: fix use-after-free in testdrv_probe()
The function testdrv_probe() retrieves the device_node from the PCI
device, applies an overlay, and then immediately calls of_node_put(dn).
This releases the reference held by the PCI core, potentially freeing
the node if the reference count drops to zero. Later, the same freed
pointer 'dn' is passed to of_platform_default_populate(), leading to a
use-after-free.
The reference to pdev->dev.of_node is owned by the device model and
should not be released by the driver. Remove the erroneous of_node_put()
to prevent premature freeing.
References
Configurations
Configuration 1 (hide)
|
History
16 Jun 2026, 13:52
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-416 | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/07fd339b2c253205794bea5d9b4b7548a4546c56 - Patch | |
| References | () https://git.kernel.org/stable/c/0ba03e06f037df704d9b032e36d417633e2326bc - Patch | |
| References | () https://git.kernel.org/stable/c/5b6122a67a295f8a08b7c18d908a1bd974dfaec8 - Patch | |
| References | () https://git.kernel.org/stable/c/6b2023286d2c6ed3bf964fb92e34c9c14d42eb69 - Patch | |
| References | () https://git.kernel.org/stable/c/d68347b07b9801791c9eaab8f772770b52b8cd5c - Patch |
27 May 2026, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-27 14:17
Updated : 2026-06-17 10:52
NVD link : CVE-2026-45989
Mitre link : CVE-2026-45989
CVE.ORG link : CVE-2026-45989
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free