CVE-2026-72047 Linux CVE debrief

Who should care

Linux kernel maintainers, developers using the ieee802154 ca8210 driver, administrators of systems with 64-bit builds and CONFIG_IEEE802154_CA8210_DEBUGFS=y enabled, and security teams responsible for vulnerability management and patching in Linux-based environments should all be aware of this issue and take necessary actions to mitigate it. Additionally, operators of affected systems and platforms should review the vulnerability and implement compensating controls if necessary. Vulnerability management teams should prioritize patching and ensure that affected systems are properly updated. Security teams should also monitor for potential exploitation attempts and review system logs for suspicious activity related to the ca8210 driver. Asset inventory management teams should verify that all affected systems are accounted for and prioritize patching accordingly. Rollback and change window management teams should plan for the necessary updates and ensure that they are properly tested and validated before deployment. Source tracking and monitoring teams should also be aware of this issue and track any potential exploitation attempts or related security events. Compensating controls such as restricting access to debugfs entries may be necessary for exposed systems while remediation is scheduled and verified. Monitoring and detection teams should check relevant logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. This should be done in accordance with standard change control processes and with proper testing and validation to ensure that the patches do not introduce any new issues. Overall, a coordinated effort is required across various teams to effectively manage and mitigate this vulnerability. The above groups should work together to ensure that all necessary steps are taken to prevent exploitation and minimize potential impact. This includes reviewing and applying patches, implementing compensating controls, monitoring for suspicious activity, and verifying that all affected systems are properly updated and secured. By taking a proactive and coordinated approach, the风险

Technical summary

The ca8210_test_int_driver_write() and ca8210_test_int_user_read() functions exchange a kmalloc'd buffer pointer through a struct kfifo. However, they pass a literal '4' as the byte count to kfifo_in()/kfifo_out(), which is correct on 32-bit systems but incorrect on 64-bit systems. This leads to only the low 4 bytes of the 8-byte pointer being written into the FIFO, causing potential arbitrary kernel address dereferences when the pointer is reconstructed and dereferenced.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to address the vulnerability.
• Ensure CONFIG_IEEE802154_CA8210_DEBUGFS is not enabled in 64-bit builds if possible.
• Monitor system logs for potential oops or crashes related to the ca8210 driver.
• Consider compensating controls such as restricting access to debugfs entries.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The issue was found via a custom Coccinelle semantic patch. The driver has no architecture restriction in Kconfig, making any 64-bit build with CONFIG_IEEE802154_CA8210_DEBUGFS=y vulnerable. This issue could lead to arbitrary kernel address dereferences when the pointer is reconstructed and dereferenced. To verify, defenders should review the ca8210 driver code, check for the CONFIG_IEEE802154_CA8210_DEBUGFS configuration, and monitor system logs for potential oops or crashes related to the ca8210 driver.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.