CVE-2026-64220

In the Linux kernel, the following vulnerability has been resolved:

device property: set fwnode->secondary to NULL in fwnode_init()

If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitalized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization.

This vulnerability is rated as Moderate because successful exploitation is limited to a local denial of service via kernel crash without compromising system confidentiality or integrity. In Red Hat Enterprise Linux environments, uninitialized pointer handling during firmware node initialization can lead to an invalid memory dereference when traversing software nodes. Exploitation requires local access, preventing remote attack vectors and limiting the blast radius to host availability disruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.