Linux Kernel CVE-2026-68461

The vulnerability resides in the Linux kernel's device property subsystem (drivers/base/property.c), specifically in fwnode_init(), the helper function for initializing struct fwnode_handle. The structure's secondary field serves as a chained firmware node pointer and is expected to be NULL-or-IS_ERR() before any safe dereference. When a caller allocates a fwnode_handle on the stack (e.g., a temporary software node with controlled lifetime) or via kmalloc() rather than kzalloc(), the fwnode_init() call prior to this fix did not zero-initialize the secondary field or any other remaining struct members, violating the invariant assumed by consumers such as dev_to_swnode(). The root cause maps to CWE-457 (Use of Uninitialized Variable) - a classic kernel memory safety defect where trust in initialization state diverges from reality. The introducing commit is 01bb86b380a306bd937c96da36f66429f3362137; the fix propagated into multiple stable series via seven distinct backport commits as recorded by EUVD-2026-59083.