CVE-2026-64220— device property: set fwnode->secondary to NULL in fwnode_init()
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 01bb86b380a306bd937c96da36f66429f3362137< f0e211d6539fae800217c10797993b7592d6ab01 | affected |
01bb86b380a306bd937c96da36f66429f3362137< 3f1024deeab3b5443c29b3de4fe475e87309b8fa | affected | ||
01bb86b380a306bd937c96da36f66429f3362137< 371f53925a6714d0aa35f1aefdffc3e8cd62f480 | affected | ||
01bb86b380a306bd937c96da36f66429f3362137< 34bf74b1fd2e4a44e27821a329204caf09df2976 | affected | ||
01bb86b380a306bd937c96da36f66429f3362137< 508fd8ab158abd04b7f7d0f707cd6d6c405df4ea | affected | ||
01bb86b380a306bd937c96da36f66429f3362137< f59e686c778cb41b8f7aa8fab2afd6a01afb3d47 | affected | ||
01bb86b380a306bd937c96da36f66429f3362137< 215c90ee656114f5e8c32408228d97082f8e0eef | affected | ||
5.11 | affected | ||
| … +8 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-64220
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
device property: set fwnode->secondary to NULL in fwnode_init()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode->secondary to NULL in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitalized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于在fwnode_init()中未将fwnode->secondary初始化为NULL，可能导致未初始化内存被解引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-64220
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-64220
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-64220 (7)
Same Patch Batch · Linux · 2026-07-24 · 48 CVEs total
| CVE-2026-64232 | 9.8 CRITICAL | block: recompute nr_integrity_segments in blk_insert_cloned_request |
| CVE-2026-64216 | 9.8 CRITICAL | netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() |
| CVE-2026-64255 | 8.8 HIGH | wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers |
| CVE-2026-64247 | 8.4 HIGH | KVM: x86: hyper-v: Bound the bank index when querying sparse banks |
| CVE-2026-64235 | 8.1 HIGH | x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines |
| CVE-2026-64223 | 8.1 HIGH | wifi: mac80211: consume only present negotiated TTLM maps |
| CVE-2026-64226 | 7.8 HIGH | sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path |
| CVE-2026-64221 | 7.8 HIGH | spi: ti-qspi: fix use-after-free after DMA setup failure |
| CVE-2026-64218 | 7.8 HIGH | batman-adv: bla: fix report_work leak on backbone_gw purge |
| CVE-2026-64251 | 7.8 HIGH | pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() |
| CVE-2026-64217 | 7.8 HIGH | netfs: Fix overrun check in netfs_extract_user_iter() |
| CVE-2026-64208 | 7.5 HIGH | crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks |
| CVE-2026-64210 | 7.5 HIGH | net/mlx5e: xsk: Fix unlocked writing to ICOSQ |
| CVE-2026-64243 | 7.1 HIGH | ASoC: codecs: simple-mux: Fix enum control bounds check |
| CVE-2026-64222 | 7.0 HIGH | octeontx2-pf: avoid double free of pool->stack on AQ init failure |
| CVE-2026-64219 | 7.0 HIGH | drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_as |
| CVE-2026-64249 | fpga: region: fix use-after-free in child_regions_with_firmware() | |
| CVE-2026-64250 | LoongArch: Report dying CPU to RCU in stop_this_cpu() | |
| CVE-2026-64224 | octeontx2-pf: fix double free in rvu_rep_rsrc_init() | |
| CVE-2026-64246 | power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() |
Showing top 20 of 48 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-64556
perf/core: Detach event groups during remove_on_exec - CVE-2026-64557
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_conne - CVE-2026-64554
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragm - CVE-2026-64555
KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops( - CVE-2026-64552
virtio-net: fix len check in receive_big()
Same vendor: Linux
- CVE-2026-64556
perf/core: Detach event groups during remove_on_exec - CVE-2026-64557
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_conne - CVE-2026-64554
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragm - CVE-2026-64555
KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops( - CVE-2026-64552
virtio-net: fix len check in receive_big()
V. Comments for CVE-2026-64220
No comments yet