CVE-2026-68461: device property: initialize the remaining fields of fwnode_handle in fwnode_init()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

device property: initialize the remaining fields of fwnode_handle in fwnode_init()

If a firmware node is allocated on the stack (for instance: temporary
software node whose life-time we control) or on the heap - but using a
non-zeroing allocation function - and initialized using fwnode_init(),
its secondary pointer will contain uninitialized memory which likely
will be neither NULL nor IS_ERR() and so may end up being dereferenced
(for example: in dev_to_swnode()). Set fwnode->secondary to NULL on
initialization. While at it: initialize the remaining fields of struct
fwnode_handle too just to be sure.

[ Fix typo in commit message. - Danilo ]

The Linux kernel CVE team has assigned CVE-2026-68461 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit 01bb86b380a306bd937c96da36f66429f3362137 and fixed in 5.15.212 with commit 0198d579948322cda5178b9672d448375a32f947
	Issue introduced in 5.11 with commit 01bb86b380a306bd937c96da36f66429f3362137 and fixed in 6.1.178 with commit 173b61c9276c7b3a5fbcc63ae7aafc897fee1e18
	Issue introduced in 5.11 with commit 01bb86b380a306bd937c96da36f66429f3362137 and fixed in 6.6.145 with commit f0b4e1cc8ad76baf49d898727eb52e91a4ef0544
	Issue introduced in 5.11 with commit 01bb86b380a306bd937c96da36f66429f3362137 and fixed in 6.12.96 with commit c8542b68ba6ef4f61072098893a3f5b71c569b6c
	Issue introduced in 5.11 with commit 01bb86b380a306bd937c96da36f66429f3362137 and fixed in 6.18.39 with commit 9c86a1f930bb2ddb85f867b4736716e82a4a4683
	Issue introduced in 5.11 with commit 01bb86b380a306bd937c96da36f66429f3362137 and fixed in 7.1.5 with commit c81e2af41de6a159837c7129a4fc444ac6e48046
	Issue introduced in 5.11 with commit 01bb86b380a306bd937c96da36f66429f3362137 and fixed in 7.2-rc1 with commit 7eba000621fff223dd7bab484d48918c7c77a307

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68461
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/linux/fwnode.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0198d579948322cda5178b9672d448375a32f947
	https://git.kernel.org/stable/c/173b61c9276c7b3a5fbcc63ae7aafc897fee1e18
	https://git.kernel.org/stable/c/f0b4e1cc8ad76baf49d898727eb52e91a4ef0544
	https://git.kernel.org/stable/c/c8542b68ba6ef4f61072098893a3f5b71c569b6c
	https://git.kernel.org/stable/c/9c86a1f930bb2ddb85f867b4736716e82a4a4683
	https://git.kernel.org/stable/c/c81e2af41de6a159837c7129a4fc444ac6e48046
	https://git.kernel.org/stable/c/7eba000621fff223dd7bab484d48918c7c77a307