CVE-2026-72489
Description
In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec_rx_completed() In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check.
How to fix
- Linux Linux6b2ea886ebdae44a2394029844a4e78f58e1587d, a37625c7b688fcf68a54263528eccbabfd7fa17a, 9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89, 08626fcfe12308ca3f8b22c538ba7dee0b2dce7a, f19a5bc059051143c489dd6f79a0f9c3bfd13aea, bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90, 5de04caa46b635e180cecbd164e333eca535db94, 26813881181deb3a32fbb59eadb2599cbe8423f6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | d6bdcf2e1019351cbc176e963b7756766bdd8721 ≤ v < 6b2ea886ebdae44a2394029844a4e78f58e1587d, d6bdcf2e1019351cbc176e963b7756766bdd8721 ≤ v < a37625c7b688fcf68a54263528eccbabfd7fa17a, d6bdcf2e1019351cbc176e963b7756766bdd8721 ≤ v < 9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89, d6bdcf2e1019351cbc176e963b7756766bdd8721 ≤ v < 08626fcfe12308ca3f8b22c538ba7dee0b2dce7a, d6bdcf2e1019351cbc176e963b7756766bdd8721 ≤ v < f19a5bc059051143c489dd6f79a0f9c3bfd13aea, d6bdcf2e1019351cbc176e963b7756766bdd8721 ≤ v < bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90, d6bdcf2e1019351cbc176e963b7756766bdd8721 ≤ v < 5de04caa46b635e180cecbd164e333eca535db94, d6bdcf2e1019351cbc176e963b7756766bdd8721 ≤ v < 26813881181deb3a32fbb59eadb2599cbe8423f6, 3.2 | 6b2ea886ebdae44a2394029844a4e78f58e1587d, a37625c7b688fcf68a54263528eccbabfd7fa17a, 9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89, 08626fcfe12308ca3f8b22c538ba7dee0b2dce7a, f19a5bc059051143c489dd6f79a0f9c3bfd13aea, bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90, 5de04caa46b635e180cecbd164e333eca535db94, 26813881181deb3a32fbb59eadb2599cbe8423f6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.