CVE-2026-68461

A flaw was found in the Linux kernel. When a firmware node is allocated and initialized using fwnode_init(), a pointer within the fwnode_handle structure may contain uninitialized memory. This can occur if a non-zeroing allocation function is used. If this uninitialized pointer is subsequently dereferenced, it could lead to system instability or a denial of service (DoS).

This vulnerability is rated as having Moderate impact because exploitation is constrained to local environments and results in a kernel crash without directly compromising system confidentiality or integrity. In standard Red Hat Enterprise Linux deployments, an attacker requires local access to trigger operations that allocate uninitialized firmware node structures. Because the defect leads to an invalid pointer dereference within kernel device management rather than arbitrary code execution or privilege escalation, the primary risk is limited to a local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.