Riskcovery

CVE-2026-45989

of: unittest: fix use-after-free in testdrv_probe()

State
Published
Severity
Not scored
Published
May 27, 2026
Updated
Jun 14, 2026
Reserved
May 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

of: unittest: fix use-after-free in testdrv_probe()

The function testdrv_probe() retrieves the device_node from the PCI device, applies an overlay, and then immediately calls of_node_put(dn). This releases the reference held by the PCI core, potentially freeing the node if the reference count drops to zero. Later, the same freed pointer 'dn' is passed to of_platform_default_populate(), leading to a use-after-free.

The reference to pdev->dev.of_node is owned by the device model and should not be released by the driver. Remove the erroneous of_node_put() to prevent premature freeing.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 26409dd045892904b059dc411403e9c8ce7543ca to before 0ba03e06f037df704d9b032e36d417633e2326bcAffected
  • 26409dd045892904b059dc411403e9c8ce7543ca to before d68347b07b9801791c9eaab8f772770b52b8cd5cAffected
  • 26409dd045892904b059dc411403e9c8ce7543ca to before 5b6122a67a295f8a08b7c18d908a1bd974dfaec8Affected
  • 26409dd045892904b059dc411403e9c8ce7543ca to before 6b2023286d2c6ed3bf964fb92e34c9c14d42eb69Affected
  • 26409dd045892904b059dc411403e9c8ce7543ca to before 07fd339b2c253205794bea5d9b4b7548a4546c56Affected
LinuxLinux
  • 6.6Affected
  • before 6.6Not affected
  • 6.6.140 through 6.6.*Not affected
  • 6.12.86 through 6.12.*Not affected
  • 6.18.27 through 6.18.*Not affected
  • 7.0.4 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.