CVE-2026-89744

In the Linux kernel, the following vulnerability has been resolved:

device property: fix infinite loop in fwnode for each child node()

When iterate over children of a fwnode that has a secondary fwnode, fwnode get next child node() can enter an infinite loop if the secondary fwnode has more than one child.

        Parent    Child

(Primary fwnode) FWa: {FWa1, FWa2, FWa3} (Secondary fwnode) FWb: {FWb1, FWb2}

In this case:

┌─> fwnode get next child node(FWa, FWa1) │ - fwnode call ptr op(FWa, get next child node, FWa1) returns FWa2 │ │ ... │ │ fwnode get next child node(FWa, FWa3) │ - fwnode call ptr op(FWa, get next child node, FWa3) returns NULL │ - fwnode call ptr op(FWb, get next child node, FWa3) returns FWb1 │ │ fwnode get next child node(FWa, FWb1) │ - fwnode call ptr op(FWa, get next child node, FWb1) returns FWa1 └────┘

This cause fwnode for each child node() to loop indefinitely, reapeatedly output {FWa1, FWa2, FWa3, FWb1, FWa1, ...}.

The root cause is that when the current child (FWb1) belongs to the secondary fwnode, calling get next child node() on the parimary fwnode incorrectly returns the first child (FWa1) again instead of NULL.

Fix this by dynamically checking the parent fwnode of the current child before calling get next child node(). This approach follows the pattern established in commit b5b41ab6b0c1 ("device property: Check fwnode->secondary in fwnode graph get next endpoint()").