PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45989 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's Open Firmware (OF) unit test driver. The `testdrv_probe()` function in the OF unittest code incorrectly releases a reference to the device tree node (`device_node`) that is owned by the device model, rather than the driver. Specifically, after retrieving `pdev->dev.of_node` and applying a device tree overlay, the code calls `of_node_put(dn)` which decrements the reference count. Since this reference is owned by the PCI core/device model and not the driver, this premature release can cause the node to be freed while still in use. The freed pointer is subsequently passed to `of_platform_default_populate()`, resulting in a use-after-free condition. The fix removes the erroneous `of_node_put()` call, allowing the device model to maintain proper ownership of the reference throughout the device's lifetime.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Linux kernel developers, distribution maintainers, organizations running custom kernel builds with unit testing enabled, embedded systems developers using device tree overlays

Technical summary

The vulnerability is located in `drivers/of/unittest.c` in the `testdrv_probe()` function. The issue stems from incorrect reference counting of device tree nodes. The function obtains a pointer to the device node via `pdev->dev.of_node`, which is a reference owned by the device model (PCI core). After applying a device tree overlay with `of_overlay_apply()`, the code erroneously calls `of_node_put(dn)`, releasing this reference. If the reference count reaches zero, the node is freed. The subsequent call to `of_platform_default_populate(dn, NULL, &pdev->dev)` then operates on freed memory. The resolution removes the `of_node_put(dn)` call, preserving the device model's ownership of the reference. This vulnerability affects kernel unit testing infrastructure and is unlikely to be present in production kernel configurations unless CONFIG_OF_UNITTEST is explicitly enabled.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel patches from stable kernel releases once available for your distribution
  • Monitor distribution security advisories for backported fixes
  • Review custom kernel builds for presence of CONFIG_OF_UNITTEST option
  • Prioritize patching on systems running kernel unit tests or development environments where OF unittest driver may be loaded

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Fix commits identified in kernel.org stable tree. No CVSS score or severity assigned by NVD at time of disclosure (status: Awaiting Analysis). Vendor attribution marked as low confidence requiring review based on reference domain analysis.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45989 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45989

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45989 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45989

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/07fd339b2c253205794bea5d9b4b7548a4546c56

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0ba03e06f037df704d9b032e36d417633e2326bc

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5b6122a67a295f8a08b7c18d908a1bd974dfaec8

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6b2023286d2c6ed3bf964fb92e34c9c14d42eb69

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d68347b07b9801791c9eaab8f772770b52b8cd5c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.