CVE & CISA-KEV Catalog

CVE-2026-46288

HIGH
8.4
CVSS v3
NVD

Description

In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-free in of_unittest_changeset() The variable 'parent' is assigned the value of 'nchangeset' earlier in the function, meaning both point to the same struct device_node. The call to of_node_put(nchangeset) can decrement the reference count to zero and free the node if there are no other holders. After that, the code still uses 'parent' to check for the presence of a property and to read a string property, leading to a use-after-free. Fix this by moving the of_node_put() call after the last access to 'parent', avoiding the UAF.

How to fix

Remediation Available
linuxDebian
Fixed in:6.12.86-1CVE-2026-46288
Fixed in:7.0.4-1CVE-2026-46288

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit Intelligence

0.14%probability of exploitation in 30 days
4thpercentile

Low risk: more likely to be exploited than 4% of all known CVEs.

References

Embed a live status badge for CVE-2026-46288
CVE-2026-46288 severity badge

Markdown

[![CVE-2026-46288](https://tridentstack.com/cve/badge/CVE-2026-46288.svg)](https://tridentstack.com/cve/CVE-2026-46288)

HTML

<a href="https://tridentstack.com/cve/CVE-2026-46288"><img src="https://tridentstack.com/cve/badge/CVE-2026-46288.svg" alt="CVE-2026-46288"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-06-14.