CVE-2026-46288: of: unittest: fix use-after-free in of_unittest_changeset()

Synopsis

A use-after-free vulnerability exists in the Linux kernel's device-tree unit-test subsystem, specifically in the of_unittest_changeset() function. An attacker with local access to the system can trigger the bug without any authentication or user interaction, exploiting a freed memory region that is still referenced through the 'parent' pointer after of_node_put() drops the reference count to zero. Successful exploitation grants full read, write, and crash capabilities on the affected host. A patched-image rebuild at the fix versions (6.12.86, 6.18.27, and the associated commit SHAs) is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to reach the vulnerable code path.

• AuthenticationNot required

  No account credentials are required; the CVSS vector specifies PR:N, meaning any unprivileged local process can trigger the vulnerability.

• Victim interactionNot required

  The exploit requires no action from any other user or process on the system; it is entirely attacker-driven.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and does not depend on race conditions, special memory layouts, or other variable environmental factors.

Blast Radius

• The attacker reads arbitrary kernel memory from the freed device-node structure, exposing data such as device-tree properties and any co-located kernel objects.
• The attacker writes into the freed memory region, allowing corruption of kernel data structures that may be reallocated at that address.
• The attacker crashes the kernel by triggering a fault on the dangling pointer access, causing a full system denial of service.
• Any combination of the above impacts can be chained in a single exploit attempt given the high confidentiality, integrity, and availability scores.