CVE-2026-68461 - Vulnerability Details

- device property: initialize the remaining fields of fwnode_handle in fwnode_init()

Description

In the Linux kernel, the following vulnerability has been resolved:

device property: initialize the remaining fields of fwnode_handle in fwnode_init()

If a firmware node is allocated on the stack (for instance: temporary
software node whose life-time we control) or on the heap - but using a
non-zeroing allocation function - and initialized using fwnode_init(),
its secondary pointer will contain uninitialized memory which likely
will be neither NULL nor IS_ERR() and so may end up being dereferenced
(for example: in dev_to_swnode()). Set fwnode->secondary to NULL on
initialization. While at it: initialize the remaining fields of struct
fwnode_handle too just to be sure.

[ Fix typo in commit message. - Danilo ]

Published: 2026-08-15

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A firmware node allocated on the stack or heap with a non‑zeroing allocator and initialized by fwnode_init() leaves the fwnode_handle->secondary pointer uninitialized. When an API later dereferences this pointer, such as dev_to_swnode(), the kernel can crash or exhibit undefined behavior, leading to a denial‑of‑service condition.

Affected Systems

All Linux kernel releases that have not incorporated the commit that sets fwnode_handle->secondary to NULL and fully initializes the structure are potentially affected. The exact version range is not specified, so any kernel lacking this patch is at risk.

Risk and Exploitability

Because the vulnerability requires the creation or manipulation of a firmware node, it is likely limited to local exploitation by code running in kernel mode (for example, a malicious driver or firmware). The CVSS score of 7.8 indicates high severity, while the EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits yet. Nevertheless, a kernel crash is a high‑risk outcome, and the lack of zeroing makes the bug trivially exploitable in a local context.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`01bb86b380a306bd937c96da36f66429f3362137`	affected	< 0198d579948322cda5178b9672d448375a32f947
`01bb86b380a306bd937c96da36f66429f3362137`	affected	< 173b61c9276c7b3a5fbcc63ae7aafc897fee1e18
`01bb86b380a306bd937c96da36f66429f3362137`	affected	< f0b4e1cc8ad76baf49d898727eb52e91a4ef0544
`01bb86b380a306bd937c96da36f66429f3362137`	affected	< c8542b68ba6ef4f61072098893a3f5b71c569b6c
`01bb86b380a306bd937c96da36f66429f3362137`	affected	< 9c86a1f930bb2ddb85f867b4736716e82a4a4683
`01bb86b380a306bd937c96da36f66429f3362137`	affected	< c81e2af41de6a159837c7129a4fc444ac6e48046
`01bb86b380a306bd937c96da36f66429f3362137`	affected	< 7eba000621fff223dd7bab484d48918c7c77a307

Linux

affected

Version	Status	Constraints
`5.11`	affected	—
`0`	unaffected	< 5.11
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[01bb86b380a306bd937c96da36f66429f3362137,0198d579948322cda5178b9672d448375a32f947)`	affected	code_commit	—
`[01bb86b380a306bd937c96da36f66429f3362137,173b61c9276c7b3a5fbcc63ae7aafc897fee1e18)`	affected	code_commit	—
`[01bb86b380a306bd937c96da36f66429f3362137,f0b4e1cc8ad76baf49d898727eb52e91a4ef0544)`	affected	code_commit	—
`[01bb86b380a306bd937c96da36f66429f3362137,c8542b68ba6ef4f61072098893a3f5b71c569b6c)`	affected	code_commit	—
`[01bb86b380a306bd937c96da36f66429f3362137,9c86a1f930bb2ddb85f867b4736716e82a4a4683)`	affected	code_commit	—
`[01bb86b380a306bd937c96da36f66429f3362137,c81e2af41de6a159837c7129a4fc444ac6e48046)`	affected	code_commit	—
`[01bb86b380a306bd937c96da36f66429f3362137,7eba000621fff223dd7bab484d48918c7c77a307)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.11`	affected	generic	—
`[0,5.11)`	unaffected	generic	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.96,6.13.0)`	unaffected	semver	—
`[6.18.39,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1, *]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the fwnode_init() fix that zeroes the secondary pointer and initializes all remaining fields.
If a kernel upgrade cannot be performed immediately, restrict or disable drivers and modules that create temporary firmware nodes to reduce the chance of a non‑zero‑ed node being allocated.
Monitor kernel logs (e.g., dmesg, /var/log/kern.log) for Oops or panic events that may indicate the vulnerability is triggered, and investigate any suspicious firmware node activity.
When developing custom kernel modules that allocate firmware nodes, use zero‑initializing allocation functions such as kzalloc and explicitly set the secondary field to NULL before use.

Generated by OpenCVE AI on August 18, 2026 at 05:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00129.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0198d579948322cda5178b9672d448375a32f947
https://git.kernel.org/stable/c/173b61c9276c7b3a5fbcc63ae7aafc897fee1e18
https://git.kernel.org/stable/c/7eba000621fff223dd7bab484d48918c7c77a307
https://git.kernel.org/stable/c/9c86a1f930bb2ddb85f867b4736716e82a4a4683
https://git.kernel.org/stable/c/c81e2af41de6a159837c7129a4fc444ac6e48046
https://git.kernel.org/stable/c/c8542b68ba6ef4f61072098893a3f5b71c569b6c
https://git.kernel.org/stable/c/f0b4e1cc8ad76baf49d898727eb52e91a4ef0544
https://lore.kernel.org/linux-cve-announce/2026081503-CVE-2026-68461-a9a4@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-68461
https://www.cve.org/CVERecord?id=CVE-2026-68461

History

Tue, 18 Aug 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-788

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026081503-CVE-2026-68461-a9a4@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-68461 https://www.cve.org/CVERecord?id=CVE-2026-68461
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-788

Mon, 17 Aug 2026 08:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-457 CWE-665

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 08:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-457 CWE-665

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnode_handle in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitialized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization. While at it: initialize the remaining fields of struct fwnode_handle too just to be sure. [ Fix typo in commit message. - Danilo ]
Title		device property: initialize the remaining fields of fwnode_handle in fwnode_init()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0198d579948322cda5178b9672d448375a32f947 https://git.kernel.org/stable/c/173b61c9276c7b3a5fbcc63ae7aafc897fee1e18 https://git.kernel.org/stable/c/7eba000621fff223dd7bab484d48918c7c77a307 https://git.kernel.org/stable/c/9c86a1f930bb2ddb85f867b4736716e82a4a4683 https://git.kernel.org/stable/c/c81e2af41de6a159837c7129a4fc444ac6e48046 https://git.kernel.org/stable/c/c8542b68ba6ef4f61072098893a3f5b71c569b6c https://git.kernel.org/stable/c/f0b4e1cc8ad76baf49d898727eb52e91a4ef0544

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:51:21.219Z

Updated: 2026-08-17T05:39:08.142Z

Reserved: 2026-07-30T09:28:09.395Z

Link: CVE-2026-68461

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:18:34.113

Modified: 2026-08-17T06:17:55.380

Link: CVE-2026-68461

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-68461 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T05:30:08Z

Weaknesses

CWE-824
Access of Uninitialized Pointer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object