Strix
61.9K

CVE-2026-68461

HIGHCVSS 7.8/10EPSS 0.17%

Last modified

CVE-2026-68461 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnode_handle in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitialized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnode_handle in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitialized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization. While at it: initialize the remaining fields of struct fwnode_handle too just to be sure. [ Fix typo in commit message. - Danilo ]

Metrics

CVSS 3.1
7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.17%

7.0th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 01bb86b380a306bd937c96da36f66429f3362137, < 0198d579948322cda5178b9672d448375a32f947; >= 01bb86b380a306bd937c96da36f66429f3362137, < 173b61c9276c7b3a5fbcc63ae7aafc897fee1e18; >= 01bb86b380a306bd937c96da36f66429f3362137, < f0b4e1cc8ad76baf49d898727eb52e91a4ef0544; >= 01bb86b380a306bd937c96da36f66429f3362137, < c8542b68ba6ef4f61072098893a3f5b71c569b6c; >= 01bb86b380a306bd937c96da36f66429f3362137, < 9c86a1f930bb2ddb85f867b4736716e82a4a4683; >= 01bb86b380a306bd937c96da36f66429f3362137, < c81e2af41de6a159837c7129a4fc444ac6e48046; >= 01bb86b380a306bd937c96da36f66429f3362137, < 7eba000621fff223dd7bab484d48918c7c77a307
LinuxLinux5.11

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-68461?
In the Linux kernel, the following vulnerability has been resolved: device property: initialize the remaining fields of fwnode_handle in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitialized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization. While at it: initialize the remaining fields of struct fwnode_handle too just to be sure. [ Fix typo in commit message. - Danilo ]
How severe is CVE-2026-68461?
CVE-2026-68461 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-68461?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-68461?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST