CVE-2026-72424 Linux Kernel CVE debrief

Who should care

Users and administrators of Linux kernel versions affected by CVE-2026-72424 should apply the fix to prevent potential NULL dereference issues in the rtc: msc313 shared IRQ handler.

Technical summary

The CVE-2026-72424 vulnerability involves a NULL dereference issue in the rtc: msc313 shared IRQ handler during probe in the Linux kernel. The problem occurs because the devm_request_irq() function is called with IRQF_SHARED and &pdev->dev as the cookie before platform_set_drvdata() is invoked. This can cause another device on the same IRQ line to trigger the handler prematurely, leading to a NULL pointer dereference. The solution is to pass the correct cookie directly to devm_request_irq() to prevent this issue, thereby removing the dependency on probe order.

Defensive priority

This vulnerability has been resolved in the Linux kernel, specifically addressing a NULL dereference issue in the rtc: msc313 shared IRQ handler during probe. The fix involves passing the correct cookie to devm_request_irq() to prevent the NULL dereference.

Recommended defensive actions

• Review and apply the Linux kernel patch for rtc: msc313 to fix the NULL dereference in the shared IRQ handler.
• Verify that the Linux kernel version in use includes the fix for CVE-2026-72424.
• Monitor for any potential exploitation attempts targeting this vulnerability.
• Perform a thorough review of system configurations to ensure that the fix is properly implemented.
• Conduct regular security audits to identify and address any potential vulnerabilities.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-72424 vulnerability involves a NULL dereference in the rtc: msc313 shared IRQ handler during probe in the Linux kernel. The issue arises because msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and &pdev->dev as the cookie before platform_set_drvdata() is called. This can lead to another device on the same IRQ line triggering the handler, which then dereferences a NULL pointer. The fix is to pass the correct cookie directly to avoid the dependency on probe order.

Official resources