CVE-2026-72424 Linux Kernel CVE debrief

Who should care

Users and administrators of Linux kernel versions affected by CVE-2026-72424 should apply the fix to prevent potential NULL dereference issues in the rtc: msc313 shared IRQ handler.

Technical summary

The CVE-2026-72424 vulnerability involves a NULL dereference issue in the rtc: msc313 shared IRQ handler during probe in the Linux kernel. The problem occurs because the devm_request_irq() function is called with IRQF_SHARED and &pdev->dev as the cookie before platform_set_drvdata() is invoked. This can cause another device on the same IRQ line to trigger the handler prematurely, leading to a NULL pointer dereference. The solution is to pass the correct cookie directly to devm_request_irq() to prevent this issue, thereby removing the dependency on probe order.

Defensive priority

This vulnerability has been resolved in the Linux kernel, specifically addressing a NULL dereference issue in the rtc: msc313 shared IRQ handler during probe. The fix involves passing the correct cookie to devm_request_irq() to prevent the NULL dereference.

Recommended defensive actions

• Review and apply the Linux kernel patch for rtc: msc313 to fix the NULL dereference in the shared IRQ handler.
• Verify that the Linux kernel version in use includes the fix for CVE-2026-72424.
• Monitor for any potential exploitation attempts targeting this vulnerability.
• Perform a thorough review of system configurations to ensure that the fix is properly implemented.
• Conduct regular security audits to identify and address any potential vulnerabilities.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-72424 vulnerability involves a NULL dereference in the rtc: msc313 shared IRQ handler during probe in the Linux kernel. The issue arises because msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and &pdev->dev as the cookie before platform_set_drvdata() is called. This can lead to another device on the same IRQ line triggering the handler, which then dereferences a NULL pointer. The fix is to pass the correct cookie directly to avoid the dependency on probe order.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.