CVE-2026-45989

About vulnerability

In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-free in testdrv_probe() The function testdrv_probe() retrieves the device_node from the PCI device, applies an overlay, and then immediately calls of_node_put(dn). This releases the reference held by the PCI core, potentially freeing the node if the reference count drops to zero. Later, the same freed pointer ‘dn’ is passed to of_platform_default_populate(), leading to a use-after-free. The reference to pdev->dev.of_node is owned by the device model and should not be released by the driver. Remove the erroneous of_node_put() to prevent premature freeing. A flaw was found in the Linux kernel, specifically within the testdrv_probe() function. This vulnerability, known as a use-after-free, occurs because the system prematurely releases a memory reference and then attempts to access that freed memory. This can be triggered by a local user, potentially leading to system instability, crashes, or in certain situations, allowing an attacker to execute unauthorized code.

Live-patch status from KernelCare for each operating system.