CVE-2026-89744

A flaw was found in the Linux kernel's device property handling. When the kernel iterates over child nodes of a firmware node (fwnode) that also has a secondary fwnode, the fwnode_get_next_child_node() function can enter an endless loop. This occurs if the secondary fwnode has multiple children, causing the primary fwnode to incorrectly return an already processed child instead of indicating no further children. This vulnerability can lead to a Denial of Service (DoS), making the system unresponsive.

A low-impact denial of service flaw was found in the Linux kernel's device property handling. When kernel code iterates over the child nodes of a firmware node (fwnode) that has a secondary fwnode with more than one child, fwnode_get_next_child_node() can incorrectly return an already-processed child instead of indicating the end of the iteration. As a result, fwnode_for_each_child_node() loops indefinitely and can make the system unresponsive. Triggering this flaw requires local access and the ability to control the system's firmware node topology (for example, through ACPI, device tree, or driver-controlled configuration), which typically requires elevated privileges, and the consequence is limited to availability, with no confidentiality or integrity impact.

This flaw affects the kernel packages in Red Hat Enterprise Linux 9 (kernel and kernel-rt) and Red Hat Enterprise Linux 10, Red Hat OpenShift Container Platform 5 through its RHEL CoreOS 9 based kernel, and Red Hat In-Vehicle OS 2. Other in-support Red Hat Enterprise Linux releases and maintenance streams, and OpenShift Container Platform 4, are not affected because the vulnerable code is not present in those kernels. Red Hat assesses this flaw as low impact because it is exploitable only through privileged local control of firmware node topology and only causes a denial of service. This differs meaningfully from the upstream CVE record, which assigns an important severity with a CVSS 8.4 score by assuming no privileges and full confidentiality and integrity impact; the Red Hat CVSS 3.1 score is 5.5 (moderate). The fix is currently deferred and is expected to be addressed in a future scheduled update of the affected products. The residual risk of the deferral is considered low because triggering the infinite loop requires privileged local access and an uncommon firmware node configuration, and the worst outcome is a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.