CVE-2026-46288: Linux Kernel Use-After-Free in OF Unit Test Code

Technical summary

In the of_unittest_changeset() function within the kernel's device tree subsystem, the variable 'parent' is assigned a reference to 'nchangeset', making both point to the same struct device_node. An of_node_put(nchangeset) call decrements the reference count and may deallocate the underlying node if no other references remain. Subsequently, the code accesses 'parent' to check for properties and read string values, triggering a use-after-free condition. The fix involves relocating the of_node_put() call to after all accesses to 'parent', restoring proper reference counting semantics and preventing access to freed memory.

Business impact

This vulnerability affects Linux kernel maintainers and organizations running kernel unit tests in development or CI/CD environments. While the affected code path is test-only (not a production code flow), the underlying memory management pattern it exemplifies is critical for kernel reliability. Systems running custom kernel builds with CONFIG_OF_UNITTEST enabled in test scenarios could experience kernel panics or memory corruption if the code path is exercised. For most production deployments with standard kernel configurations, the practical exposure is minimal, as unit tests are typically disabled or not executed during normal system operation.

Affected systems

The vulnerability resides in the Linux kernel device tree (OF) unit testing framework. It is only exposed in kernel builds that include and execute the OF_UNITTEST code path, typically in development kernels or CI/CD test environments. Production systems running standard kernel builds with unit tests disabled are not affected. The issue affects multiple Linux kernel versions prior to patching; check your kernel version against the vendor's advisory for specific affected ranges.

Exploitability

Exploitability requires local access and the ability to trigger the of_unittest_changeset() function, which is not part of the normal kernel runtime—it is a test-time facility. The vulnerability cannot be triggered remotely or without executing test code explicitly. However, once the test is run, the use-after-free can lead to kernel memory corruption. The CVSS 3.1 score of 8.4 (HIGH) reflects the severity of the impact if exploited: high confidentiality, integrity, and availability consequences due to the memory safety nature of the flaw.

Remediation

Update the Linux kernel to a patched version addressing CVE-2026-46288. The fix is straightforward: relocating the of_node_put() call to after the last access to 'parent' in of_unittest_changeset(). Verify the specific kernel version containing the patch against the official Linux kernel security advisories or your distribution's security notices. For systems where the OF_UNITTEST code is not compiled or used, the exposure is reduced, though patching is still recommended for completeness.

Patch guidance

Apply the official Linux kernel patch for CVE-2026-46288 as published by the Linux kernel maintainers. Kernel distributions (Ubuntu, Red Hat, Debian, etc.) will release updated kernel packages; check your distribution's security advisory page for the affected versions and available updates. Test the patched kernel in a non-production environment before deployment. If you maintain custom kernels, verify that the patch has been cherry-picked or merged into your build.

Detection guidance

Monitor kernel logs and crash dumps for panics or memory corruption originating from the device tree or OF subsystem code paths. Systems executing kernel unit tests with OF_UNITTEST enabled should be audited to confirm test execution and any associated errors. Use KASAN (Kernel Address Sanitizer) or similar debugging tools in test environments to detect use-after-free conditions earlier in development. Check your kernel build configuration to confirm whether CONFIG_OF_UNITTEST is enabled; if not, the attack surface is eliminated.

Why prioritize this

While the CVSS score is HIGH (8.4), the practical prioritization depends on your environment. If you run production systems with standard kernel builds, this is lower priority because unit tests are not part of the normal runtime. However, if you maintain kernel development builds, CI/CD test suites, or custom kernels with testing enabled, this should be prioritized as it can cause system instability and data corruption. The memory safety implications and the simplicity of the fix warrant prompt remediation in development and test environments.

Risk score, explained

The CVSS 3.1 score of 8.4 (HIGH) reflects the attack vector (local), complexity (low), and impact (high across confidentiality, integrity, and availability). The score is appropriate for a use-after-free flaw that can corrupt kernel memory and crash the system. However, the practical risk is moderated by the fact that this is test code, not production code path, and requires explicit execution of unit tests to trigger. Organizations should adjust their internal risk rating based on whether unit test code is present and executed in their kernel configurations.

Frequently asked questions