PatchSiren cyber security CVE debrief

CVE-2026-46288 Linux CVE debrief

A high-severity vulnerability, CVE-2026-46288, was found in the Linux kernel. This vulnerability is caused by a use-after-free in the of_unittest_changeset() function. The function assigns the value of 'nchangeset' to the variable 'parent' early on, causing both to point to the same struct device_node. When of_node_put(nchangeset) is called, it can reduce the reference count to zero and free the node if there are no other holders. However, the code continues to use 'parent' to check for the presence of a property and read a string property, resulting in a use-after-free. To fix this, the of_node_put() call should be moved after the last access to 'parent', preventing the UAF.

Vendor: Linux
Product: Unknown
CVSS: HIGH 8.4
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-08
Original CVE updated: 2026-07-23
Advisory published: 2026-06-08
Advisory updated: 2026-07-23

Who should care

This vulnerability affects users of the Linux kernel. The CVSS score of 8.4 and a HIGH severity rating indicate that this vulnerability could have significant impacts if exploited.

Technical summary

The vulnerability is a use-after-free in the of_unittest_changeset() function of the Linux kernel. The issue arises from the premature call to of_node_put(nchangeset), which can free the node before it is last accessed through the 'parent' variable.

Defensive priority

HIGH

Recommended defensive actions

Apply the patches provided in the kernel.org references to fix the vulnerability.
Ensure that your Linux kernel is updated with the latest security patches.

Evidence notes

The CVE-2026-46288 vulnerability was published on 2026-06-08 and modified on 2026-06-14. The vulnerability has a CVSS score of 8.4 and is considered HIGH severity.

Sources and references

Verified primary and authoritative sources

CVE-2026-46288 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-46288

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-46288 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46288

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/37318d1a27c9cc5a70d3cd7e49e30ec86f2b8ca1

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/6fdad20b7975bdc32e85b45f8f7c640f6687b81f

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/7f0f0926f3010b10cff5e93446258f971e42f2fd

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/faecdd423c27f0d6090156a435ba9dbbac0eaddb

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.