CVE-2026-45989

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified) openSUSE Tumbleweed versions prior to kernel-devel-7.0.11-1.1

Description A use-after-free issue exists in the testdrv probe() function. The function retrieves the device node from the PCI device, applies an overlay, and calls of node put(dn), which releases the reference held by the PCI core. If the reference count drops to zero, the node is freed. Subsequently, the freed pointer dn is passed to of platform default populate(), resulting in a use-after-free condition. This occurs because the reference to pdev->dev.of node is owned by the device model and should not be released by the driver.

Recommendations For Linux kernel, remove the erroneous of node put() call within the testdrv probe() function to prevent premature freeing of the node. For openSUSE Tumbleweed, update to version kernel-devel-7.0.11-1.1.