CVE-2026-46288: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46288 Overview

CVE-2026-46288 is a use-after-free vulnerability in the Linux kernel's Open Firmware (OF) device tree unittest code. The flaw resides in the of_unittest_changeset() function, where the variable parent aliases the same struct device_node as nchangeset. A call to of_node_put(nchangeset) can decrement the reference count to zero and free the underlying node. Subsequent reads through parent to check a property and read a string property then access freed memory. Maintainers resolved the issue by reordering the of_node_put() call to occur after the last access to parent.

Critical Impact
A use-after-free in kernel device tree unittest code can lead to memory corruption, kernel instability, or information disclosure when the unittest path executes.

Affected Products

Linux kernel (mainline) prior to the fix commit faecdd423c27
Stable kernel branches receiving backports referenced in commits 37318d1a27c9, 6fdad20b7975, and 7f0f0926f301
Distributions shipping affected kernels with CONFIG_OF_UNITTEST enabled

Discovery Timeline

2026-06-08 - CVE-2026-46288 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46288

Vulnerability Analysis

The defect is a use-after-free [CWE-416] in the Linux kernel's device tree subsystem unittest. Inside of_unittest_changeset(), the local pointer parent is assigned the same struct device_node value as nchangeset. Both pointers reference one allocation with a shared reference count.

The code then calls of_node_put(nchangeset). When no other holders exist, this decrements the refcount to zero and frees the node. After the free, the function continues to dereference parent to query for a property and to read a string property. These accesses occur on memory that has been released back to the allocator.

Use-after-free conditions in kernel context can yield undefined behavior. Possible outcomes include kernel crashes, leakage of reallocated memory contents, and in adversarial scenarios, controlled corruption of kernel structures. Triggering requires execution of the unittest code path, which depends on CONFIG_OF_UNITTEST and typically runs at boot.

Root Cause

The root cause is incorrect ordering of reference-count release versus pointer use. The author treated parent and nchangeset as logically distinct, but both refer to the same node. Releasing the reference through one pointer invalidates the other.

Attack Vector

The code lives in drivers/of/unittest.c, which executes only when the unittest is enabled. Production kernels generally do not ship with CONFIG_OF_UNITTEST=y. The practical exposure is limited to developers, kernel CI systems, and distributions that include the unittest. No remote attack vector exists.

No exploitation code is published for this issue. See the patch commits for the precise diff: Linux Kernel Commit faecdd4.

Detection Methods for CVE-2026-46288

Indicators of Compromise

Kernel oops or panic traces referencing of_unittest_changeset during boot or test runs
KASAN reports flagging use-after-free in drivers/of/unittest.c against a freed device_node
Unexpected slab corruption messages following execution of OF unittests

Detection Strategies

Build affected kernels with CONFIG_KASAN=y and CONFIG_OF_UNITTEST=y to surface the UAF deterministically during testing
Compare installed kernel versions against the fix commits 37318d1a27c9, 6fdad20b7975, 7f0f0926f301, and faecdd423c27 to determine patch status
Audit kernel configuration in shipped images to confirm whether the unittest path is compiled in

Monitoring Recommendations

Collect and centralize dmesg and kernel.log output from boot to detect KASAN reports and oops events
Monitor crash reporting pipelines for stack traces involving of_unittest_changeset or adjacent OF unittest symbols
Track upstream stable tree updates for the of: subsystem to confirm backports reach managed fleets

How to Mitigate CVE-2026-46288

Immediate Actions Required

Apply the upstream fix that moves of_node_put() after the last access to parent in of_unittest_changeset()
Rebuild and deploy kernels including commit faecdd423c27 or the corresponding stable backports
Disable CONFIG_OF_UNITTEST in production kernel configurations where the unittest is not required

Patch Information

The fix is published across the following commits in the stable trees:

Workarounds

Set CONFIG_OF_UNITTEST=n when building production kernels to avoid compiling the vulnerable function
Restrict execution of kernel test images to isolated lab systems until patched builds are available
Track distribution security advisories and apply vendor-provided kernel updates as they ship

bash

# Verify whether the OF unittest is enabled in the running kernel config
zcat /proc/config.gz 2>/dev/null | grep CONFIG_OF_UNITTEST || \
  grep CONFIG_OF_UNITTEST /boot/config-$(uname -r)

# Confirm running kernel version against patched stable releases
uname -r