CVE-2026-64220: Linux kernel · device property: set fwnode->secondary to NULL in fwnode_init()
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f59e686c778cb41b8f7aa8fab2afd6a01afb3d47 : update Linux kernel when convenient.
Data as of 6 Nov 2026, 17:02 UTC
Rated Low by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in f59e686c778cb41b8f7aa8fab2afd6a01afb3d47, f0e211d6539fae800217c10797993b7592d6ab01, 508fd8ab158abd04b7f7d0f707cd6d6c405df4ea +4
Exploitation evidence
Disclosed: evidence found.
CVE published 24 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in the Linux kernel. Users should update to a kernel version that includes the fix identified by commits such as f59e686c778cb41b8f7aa8fab2afd6a01afb3d47 and others listed. No additional mitigation steps are required beyond applying the official patch.
Description
A vulnerability in the Linux kernel's device property initialization function (fwnode_init) could lead to the use of uninitialized memory in the fwnode->secondary pointer. This occurs when a firmware node is allocated on the stack or heap using a non-zeroing allocation function, causing potential dereferencing of invalid memory. The issue has been fixed by explicitly setting fwnode->secondary to NULL during initialization.
References
- git.kernel.org/stable/c/f0e211d6539fae800217c10797993b7592d6ab01 (opens in a new tab)
- git.kernel.org/stable/c/3f1024deeab3b5443c29b3de4fe475e87309b8fa (opens in a new tab)
- git.kernel.org/stable/c/371f53925a6714d0aa35f1aefdffc3e8cd62f480 (opens in a new tab)
- git.kernel.org/stable/c/34bf74b1fd2e4a44e27821a329204caf09df2976 (opens in a new tab)
- git.kernel.org/stable/c/508fd8ab158abd04b7f7d0f707cd6d6c405df4ea (opens in a new tab)
- git.kernel.org/stable/c/f59e686c778cb41b8f7aa8fab2afd6a01afb3d47 (opens in a new tab)
- git.kernel.org/stable/c/215c90ee656114f5e8c32408228d97082f8e0eef (opens in a new tab)