CVE-2026-68461

Source
https://cve.org/CVERecord?id=CVE-2026-68461
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68461.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68461
Downstream
Published
2026-08-15T05:51:21.219Z
Modified
2026-08-16T03:48:26.181649769Z
Summary
device property: initialize the remaining fields of fwnode_handle in fwnode_init()
Details

In the Linux kernel, the following vulnerability has been resolved:

device property: initialize the remaining fields of fwnodehandle in fwnodeinit()

If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnodeinit(), its secondary pointer will contain uninitialized memory which likely will be neither NULL nor ISERR() and so may end up being dereferenced (for example: in devtoswnode()). Set fwnode->secondary to NULL on initialization. While at it: initialize the remaining fields of struct fwnode_handle too just to be sure.

[ Fix typo in commit message. - Danilo ]

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68461.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
01bb86b380a306bd937c96da36f66429f3362137
Fixed
0198d579948322cda5178b9672d448375a32f947
Fixed
173b61c9276c7b3a5fbcc63ae7aafc897fee1e18
Fixed
f0b4e1cc8ad76baf49d898727eb52e91a4ef0544
Fixed
c8542b68ba6ef4f61072098893a3f5b71c569b6c
Fixed
9c86a1f930bb2ddb85f867b4736716e82a4a4683
Fixed
c81e2af41de6a159837c7129a4fc444ac6e48046
Fixed
7eba000621fff223dd7bab484d48918c7c77a307

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68461.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.212
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.178
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.145
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.96
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.39
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.5

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68461.json"