CVE-2026-45989: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45989 Overview

CVE-2026-45989 is a use-after-free vulnerability in the Linux kernel's Open Firmware (OF) unittest code, specifically within the testdrv_probe() function. The function retrieves a device_node from a PCI device, applies an overlay, and then calls of_node_put(dn). This call releases the reference held by the PCI core and can free the node when the reference count reaches zero. The same freed pointer dn is then passed to of_platform_default_populate(), resulting in a use-after-free condition. The fix removes the erroneous of_node_put() because the reference to pdev->dev.of_node is owned by the device model and must not be released by the driver.

Critical Impact
Use-after-free on a kernel device_node pointer can lead to memory corruption, kernel instability, or local privilege escalation when triggered through the OF unittest driver path.

Affected Products

Linux kernel (upstream) — OF unittest subsystem
Stable kernel branches receiving the referenced backport commits
Distributions shipping kernels that include the OF unittest testdrv_probe() code path

Discovery Timeline

2026-05-27 - CVE-2026-45989 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45989

Vulnerability Analysis

The vulnerability resides in the testdrv_probe() function inside the kernel's Open Firmware (OF) unittest infrastructure. During PCI driver probing, the function obtains a device_node pointer (dn) from the associated PCI device. After applying a device tree overlay, the driver incorrectly calls of_node_put(dn), dropping a reference it does not own.

The reference to pdev->dev.of_node is managed by the device model. Releasing it from within the driver can decrement the refcount to zero, triggering deallocation of the underlying node structure. The function then continues to use the now-dangling dn pointer as an argument to of_platform_default_populate(), dereferencing freed memory [CWE-416].

Root Cause

The root cause is incorrect reference counting. Drivers must not release references they do not own. By calling of_node_put() on a node whose lifetime is governed by the PCI device structure, the driver removed a reference that the device model expected to persist, opening a window in which the node could be freed while still in active use.

Attack Vector

Reaching the vulnerable code path requires loading and exercising the OF unittest driver against a PCI device. In environments where this unittest infrastructure is enabled, local access capable of triggering the probe sequence can induce the use-after-free. The vulnerability manifests as kernel memory corruption rather than a remotely reachable condition. Refer to the upstream patch commits for the exact code-level fix.

Detection Methods for CVE-2026-45989

Indicators of Compromise

Kernel panics, oops messages, or KASAN reports referencing testdrv_probe, of_node_put, or of_platform_default_populate.
Slab corruption warnings on device_node allocations following OF unittest execution.
Unexpected kernel crashes correlated with loading of the OF unittest module on systems exposing PCI devices to the test driver.

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and pre-production kernels to surface use-after-free accesses on device_node objects.
Audit installed kernel versions against the fixed commits (07fd339b, 0ba03e06, 5b6122a6, 6b202328, d68347b0) to identify unpatched builds.
Review kernel logs for repeated faults originating in the OF unittest code path.

Monitoring Recommendations

Forward kernel ring buffer and dmesg output to centralized logging and alert on oops or KASAN signatures.
Track kernel package versions across the fleet and flag hosts running pre-fix builds.
Monitor for unexpected loading of OF unittest modules in production environments where they should not be present.

How to Mitigate CVE-2026-45989

Immediate Actions Required

Apply the upstream stable kernel patch removing the erroneous of_node_put(dn) call in testdrv_probe().
Update to a distribution kernel that incorporates one of the referenced fix commits.
Disable the OF unittest module in production kernels where it is not required.

Patch Information

The fix has been merged into upstream and stable kernel trees through the following commits: Kernel Git Commit 07fd339b, Kernel Git Commit 0ba03e06, Kernel Git Commit 5b6122a6, Kernel Git Commit 6b202328, and Kernel Git Commit d68347b0. The patch removes the unnecessary of_node_put(dn) so the device model retains ownership of the pdev->dev.of_node reference.

Workarounds

Build production kernels without the OF unittest configuration option enabled.
Restrict loading of the OF unittest module to controlled test environments only.
Limit local access on systems running unpatched kernels with the unittest infrastructure compiled in.

bash

# Verify the running kernel and check for the fix
uname -r

# On Debian/Ubuntu: update to the latest patched kernel
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')

# On RHEL/Fedora: update kernel package
sudo dnf update kernel

# Reboot to load the patched kernel
sudo systemctl reboot