A flaw in the Linux kernel device property management can lead to an infinite loop, resulting in a denial of service for the affected system.

The vulnerability exists within the fwnode_for_each_child_node function, where improper handling of secondary fwnodes during child node iteration causes an infinite loop. This issue is exploitable by an attacker with local access (or via local processes) as the vulnerability does not require authentication, according to the CVSS vector (PR:N).

The primary impact of this vulnerability is a local denial of service, as the infinite loop consumes system resources and halts processing for the affected component. While the CVSS score of 8.4 suggests high severity, the impact is localized to system stability rather than remote data exfiltration. Unmanaged kernel hangs can lead to unplanned downtime for critical infrastructure relying on the Linux kernel.

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs and performance metrics for unexplained CPU spikes or process hangs associated with device property iteration tasks.

Compensating Controls: Ensure that untrusted local users have restricted access to system calls and hardware interfaces, which may limit the ability to trigger code paths that interact with fwnode structures.

Public Exploit Available: No

Given the potential for system instability and the high CVSS severity score, administrators should prioritize applying the provided kernel patches across all relevant environments. Testing these updates in a staging environment is advised to ensure compatibility before deploying to production systems.