## Summary
CVE-2026-68461 fixes an issue in the Linux kernel where fwnode_init() could leave struct fwnode_handle fields uninitialized when the firmware node memory was allocated without zeroing. This can cause invalid pointer dereferences (e.g., via dev_to_swnode()), leading to memory corruption and crashes.
## Technical Details
- Root cause: when a firmware node is allocated on the stack or heap using a non-zeroing allocator and then initialized with fwnode_init(), the fwnode_handle may retain uninitialized contents.
- Specifically, the secondary pointer may contain garbage that is neither NULL nor IS_ERR(), and therefore may be dereferenced.
- Example dereference path mentioned in the advisory: dev_to_swnode().
- Fix: initialize fwnode->secondary to NULL during fwnode_init(), and also initialize other remaining fields of struct fwnode_handle for safety.
- Code location referenced in the patch: include/linux/fwnode.h (changes within fwnode_init(struct fwnode_handle *fwnode, const struct fwnode_operations *ops)).
## Affected
- Linux kernel component: device property / firmware node handling via fwnode_init().
- The issue applies when firmware nodes are allocated using non-zeroing allocation functions and then initialized with fwnode_init().
## Impact
- Potential kernel crash or memory corruption due to dereferencing an invalid secondary pointer.
- CVSS indicates high severity (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) with local attack vector.
## Mitigation
1. Upgrade to a kernel version that includes the fix commit 7eba000621fff223dd7bab484d48918c7c77a307 (and/or the stable backports shown as 0198d579948322cda5178b9672d448375a32f947 and 173b61c9276c7b3a5fbcc63ae7aafc897fee1e18).
2. For downstream kernels, ensure fwnode_init() sets fwnode->secondary = NULL and initializes remaining struct fwnode_handle fields (as implemented in include/linux/fwnode.h).
3. Audit any code paths that allocate temporary firmware nodes using non-zeroing allocators and then call fwnode_init() to ensure the fixed behavior is present.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H