CVE-2026-72489

staging: nvec: fix use-after-free in nvec_rx_completed()

State: Published
Severity: 8.4 High
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

staging: nvec: fix use-after-free in nvec_rx_completed()

In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type.

Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free.

Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d6bdcf2e1019351cbc176e963b7756766bdd8721 to before 6b2ea886ebdae44a2394029844a4e78f58e1587dAffected d6bdcf2e1019351cbc176e963b7756766bdd8721 to before a37625c7b688fcf68a54263528eccbabfd7fa17aAffected d6bdcf2e1019351cbc176e963b7756766bdd8721 to before 9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89Affected d6bdcf2e1019351cbc176e963b7756766bdd8721 to before 08626fcfe12308ca3f8b22c538ba7dee0b2dce7aAffected d6bdcf2e1019351cbc176e963b7756766bdd8721 to before f19a5bc059051143c489dd6f79a0f9c3bfd13aeaAffected d6bdcf2e1019351cbc176e963b7756766bdd8721 to before bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90Affected d6bdcf2e1019351cbc176e963b7756766bdd8721 to before 5de04caa46b635e180cecbd164e333eca535db94Affected d6bdcf2e1019351cbc176e963b7756766bdd8721 to before 26813881181deb3a32fbb59eadb2599cbe8423f6Affected
LinuxLinux	3.2Affected before 3.2Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

d6bdcf2e1019351cbc176e963b7756766bdd8721 to before 6b2ea886ebdae44a2394029844a4e78f58e1587dAffected
d6bdcf2e1019351cbc176e963b7756766bdd8721 to before a37625c7b688fcf68a54263528eccbabfd7fa17aAffected
d6bdcf2e1019351cbc176e963b7756766bdd8721 to before 9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89Affected
d6bdcf2e1019351cbc176e963b7756766bdd8721 to before 08626fcfe12308ca3f8b22c538ba7dee0b2dce7aAffected
d6bdcf2e1019351cbc176e963b7756766bdd8721 to before f19a5bc059051143c489dd6f79a0f9c3bfd13aeaAffected
d6bdcf2e1019351cbc176e963b7756766bdd8721 to before bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90Affected
d6bdcf2e1019351cbc176e963b7756766bdd8721 to before 5de04caa46b635e180cecbd164e333eca535db94Affected
d6bdcf2e1019351cbc176e963b7756766bdd8721 to before 26813881181deb3a32fbb59eadb2599cbe8423f6Affected

LinuxLinux

3.2Affected
before 3.2Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.