Medium 5.5Published Jul 24, 2026

CVE-2026-64220device property: set fwnode->secondary to NULL in fwnode_init()

Updated under an hour ago (Oct 27, 2026, 12:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: device property: set fwnode->secondary to NULL in fwnode_init() If a firmware node is allocated on the stack (for instance: temporary software node whose life-time we control) or on the heap - but using a non-zeroing allocation function - and initialized using fwnode_init(), its secondary pointer will contain uninitalized memory which likely will be neither NULL nor IS_ERR() and so may end up being dereferenced (for example: in dev_to_swnode()). Set fwnode->secondary to NULL on initialization.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jul 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 01bb86b380a306bd937c96da36f66429f3362137 before f0e211d6539fae800217c10797993b7592d6ab01; from 01bb86b380a306bd937c96da36f66429f3362137 before 3f1024deeab3b5443c29b3de4fe475e87309b8fa; from 01bb86b380a306bd937c96da36f66429f3362137 before 371f53925a6714d0aa35f1aefdffc3e8cd62f480; from 01bb86b380a306bd937c96da36f66429f3362137 before 34bf74b1fd2e4a44e27821a329204caf09df2976; from 01bb86b380a306bd937c96da36f66429f3362137 before 508fd8ab158abd04b7f7d0f707cd6d6c405df4ea; from 01bb86b380a306bd937c96da36f66429f3362137 before f59e686c778cb41b8f7aa8fab2afd6a01afb3d47; from 01bb86b380a306bd937c96da36f66429f3362137 before 215c90ee656114f5e8c32408228d97082f8e0eef	CNA record
linux linux_kernel linux:linux_kernel	from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; 7.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/f0e211d6539fae800217c10797993b7592d6ab01	patch
https://git.kernel.org/stable/c/3f1024deeab3b5443c29b3de4fe475e87309b8fa	patch
https://git.kernel.org/stable/c/371f53925a6714d0aa35f1aefdffc3e8cd62f480	patch
https://git.kernel.org/stable/c/34bf74b1fd2e4a44e27821a329204caf09df2976	patch
https://git.kernel.org/stable/c/508fd8ab158abd04b7f7d0f707cd6d6c405df4ea	patch
https://git.kernel.org/stable/c/f59e686c778cb41b8f7aa8fab2afd6a01afb3d47	patch
https://git.kernel.org/stable/c/215c90ee656114f5e8c32408228d97082f8e0eef	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.