Tracker / CVE-2026-64220
CVE-2026-64220
Medium 5.5
In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode->secondary to NULL in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitalized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization.
Affected products and versions
| linux | linux_kernel |
|---|---|
| linux | linux_kernel · 5.11 → 5.15.209 |
| linux | linux_kernel · 5.16 → 6.1.175 |
| linux | linux_kernel · 6.13 → 6.18.34 |
| linux | linux_kernel · 6.19 → 7.0.11 |
| linux | linux_kernel · 6.2 → 6.6.142 |
| linux | linux_kernel · 6.7 → 6.12.92 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.