CVE-2026-89744: Linux Kernel Infinite Loop DOS Vulnerability

CVE-2026-89744 Overview

CVE-2026-89744 is a Linux kernel vulnerability in the device property subsystem. The flaw resides in fwnode_get_next_child_node(), which enters an infinite loop when iterating over the children of a firmware node (fwnode) that has both a primary fwnode and a secondary fwnode containing multiple children. The looping behavior consumes CPU cycles indefinitely and blocks the calling kernel thread, resulting in denial of service on affected local systems.

Critical Impact
A local attacker or triggering condition can cause the kernel to enter an infinite iteration over firmware node children, leading to CPU exhaustion and system unresponsiveness.

Affected Products

Linux kernel versions containing the pre-patch implementation of fwnode_get_next_child_node() in the device property subsystem
Distributions shipping affected upstream kernels prior to the referenced stable commits
Systems using firmware nodes (ACPI, Device Tree, software nodes) with secondary fwnodes exposing multiple child nodes

Discovery Timeline

2026-09-11 - CVE-2026-89744 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89744

Vulnerability Analysis

The vulnerability affects the fwnode_for_each_child_node() iteration helper in the Linux kernel device property framework. Firmware nodes may have a secondary fwnode attached to represent supplementary properties, and iteration is intended to traverse the primary children first and then the secondary children. When the secondary fwnode contains more than one child, the iterator fails to detect that the current child belongs to the secondary fwnode. Instead of continuing forward or returning NULL, it restarts iteration from the first child of the primary fwnode. This produces a cycle such as {FWa1, FWa2, FWa3, FWb1, FWa1, ...} that never terminates.

This is an infinite loop condition classified under resource exhaustion. Any kernel path invoking fwnode_for_each_child_node() on a qualifying fwnode topology will stall, holding CPU and potentially locks.

Root Cause

The root cause is that fwnode_get_next_child_node() invokes fwnode_call_ptr_op(FWa, get_next_child_node, child) without first verifying which fwnode the current child belongs to. When child is a member of the secondary fwnode FWb, calling get_next_child_node on the primary FWa returns FWa's first child again rather than NULL. The upstream fix dynamically checks the parent fwnode of the current child before dispatching the call, mirroring the pattern established in commit b5b41ab6b0c1 for fwnode_graph_get_next_endpoint().

Attack Vector

Exploitation requires a local trigger. An attacker or subsystem that causes iteration over an fwnode with a secondary fwnode holding two or more children can drive the kernel into the loop. Realistic triggers include driver probe paths, device tree overlays, ACPI enumeration events, or software node registrations that construct the vulnerable topology. Successful exploitation results in CPU exhaustion, unresponsive kernel threads, and potential system-wide denial of service.

No verified public exploit code is available. Refer to the Linux Kernel Commit ba69d892ff4 for the upstream fix and technical context.

Detection Methods for CVE-2026-89744

Indicators of Compromise

Kernel threads pinned at 100% CPU utilization with stack traces referencing fwnode_get_next_child_node or fwnode_for_each_child_node
Soft lockup or RCU stall warnings in dmesg originating from driver probe or device enumeration paths
System unresponsiveness following device hotplug, ACPI events, or module load involving fwnode-based drivers

Detection Strategies

Compare running kernel version and patch level against the fixed stable commits referenced in the upstream advisory
Enable kernel lockup detectors (softlockup_panic, hardlockup_panic) to surface hangs originating in fwnode iteration
Use perf or ftrace to sample on-CPU kernel stacks and identify repeated invocations of fwnode_call_ptr_op in tight loops

Monitoring Recommendations

Aggregate kernel logs centrally and alert on soft lockup, rcu_sched detected stalls, and hung task messages
Monitor per-CPU utilization for sustained kernel-mode saturation without corresponding user workload
Track driver probe failures and repeated device enumeration events that may correlate with the vulnerable topology

How to Mitigate CVE-2026-89744

Immediate Actions Required

Inventory Linux systems and identify kernels that do not include the upstream fix commits for fwnode_get_next_child_node()
Apply the kernel updates published by your Linux distribution vendor that incorporate the referenced stable commits
Prioritize patching on systems that load device drivers relying on secondary fwnodes such as ACPI-augmented device tree nodes

Patch Information

The fix has been merged across multiple stable trees. Refer to the following upstream commits for the corrective change and backports:

The corrective patch adds a runtime check on the parent fwnode of the current child before invoking get_next_child_node, ensuring iteration terminates correctly when the secondary fwnode is exhausted.

Workarounds

No configuration-based workaround is documented; patching to a fixed kernel is the supported remediation
Where immediate patching is not feasible, avoid loading drivers or overlays that construct fwnode hierarchies with multi-child secondary fwnodes
Enable kernel soft lockup detection to force early failure and recovery rather than silent CPU exhaustion