CVE-2026-72133

spi: uniphier: Fix completion initialization order before devm_request_irq()

State: Published
Severity: 8.4 High
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

spi: uniphier: Fix completion initialization order before devm_request_irq()

The driver calls devm_request_irq() before initializing the completion used by the interrupt handler. Because the interrupt may occur immediately after devm_request_irq(), the handler may execute before init_completion().

This may result in calling complete() on an uninitialized completion, causing undefined behavior. This has been observed with KASAN.

Fix this by initializing the completion before registering the IRQ.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before b9fcf0db433d79648ace74bc2b8b88f91e306304Affected 5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before 82a5746c4c9e94f6f816ec7edea6ddc24417c6a5Affected 5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before f4bb0a91f7badd6d15ac8d783a1169d9e1e95c17Affected 5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before 49f6705d80b5e6175d8435d9c72b66bd516a8e89Affected 5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before 8b5798ce0007874c14611b8ee4ce6c749855260eAffected 5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before d44b828eb551bd59ba9f22457825cc3db3a39fc1Affected 5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before 077a7bc1c32d3da9670c5e282ea3e5ac8a94be59Affected 5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before f3ad1c87d8201e54b66bd6072442f0b5d5a308eeAffected
LinuxLinux	4.19Affected before 4.19Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before b9fcf0db433d79648ace74bc2b8b88f91e306304Affected
5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before 82a5746c4c9e94f6f816ec7edea6ddc24417c6a5Affected
5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before f4bb0a91f7badd6d15ac8d783a1169d9e1e95c17Affected
5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before 49f6705d80b5e6175d8435d9c72b66bd516a8e89Affected
5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before 8b5798ce0007874c14611b8ee4ce6c749855260eAffected
5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before d44b828eb551bd59ba9f22457825cc3db3a39fc1Affected
5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before 077a7bc1c32d3da9670c5e282ea3e5ac8a94be59Affected
5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177 to before f3ad1c87d8201e54b66bd6072442f0b5d5a308eeAffected

LinuxLinux

4.19Affected
before 4.19Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.