PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45989 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's Open Firmware (OF) unit test driver. The `testdrv_probe()` function in the OF unittest code incorrectly releases a reference to the device tree node (`device_node`) that is owned by the device model, rather than the driver. Specifically, after retrieving `pdev->dev.of_node` and applying a device tree overlay, the code calls `of_node_put(dn)` which decrements the reference count. Since this reference is owned by the PCI core/device model and not the driver, this premature release can cause the node to be freed while still in use. The freed pointer is subsequently passed to `of_platform_default_populate()`, resulting in a use-after-free condition. The fix removes the erroneous `of_node_put()` call, allowing the device model to maintain proper ownership of the reference throughout the device's lifetime.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux kernel developers, distribution maintainers, organizations running custom kernel builds with unit testing enabled, embedded systems developers using device tree overlays

Technical summary

The vulnerability is located in `drivers/of/unittest.c` in the `testdrv_probe()` function. The issue stems from incorrect reference counting of device tree nodes. The function obtains a pointer to the device node via `pdev->dev.of_node`, which is a reference owned by the device model (PCI core). After applying a device tree overlay with `of_overlay_apply()`, the code erroneously calls `of_node_put(dn)`, releasing this reference. If the reference count reaches zero, the node is freed. The subsequent call to `of_platform_default_populate(dn, NULL, &pdev->dev)` then operates on freed memory. The resolution removes the `of_node_put(dn)` call, preserving the device model's ownership of the reference. This vulnerability affects kernel unit testing infrastructure and is unlikely to be present in production kernel configurations unless CONFIG_OF_UNITTEST is explicitly enabled.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable kernel releases once available for your distribution
  • Monitor distribution security advisories for backported fixes
  • Review custom kernel builds for presence of CONFIG_OF_UNITTEST option
  • Prioritize patching on systems running kernel unit tests or development environments where OF unittest driver may be loaded

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Fix commits identified in kernel.org stable tree. No CVSS score or severity assigned by NVD at time of disclosure (status: Awaiting Analysis). Vendor attribution marked as low confidence requiring review based on reference domain analysis.

Official resources

2026-05-27