CVE-2026-72048 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems, especially those using the ieee802154 subsystem and ca8210 driver, should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing and applying patches, monitoring system logs, and implementing compensating controls as needed. The vulnerability's impact on system security and stability should be carefully assessed, and affected systems should be prioritized for remediation based on their criticality and exposure. Additionally, Linux kernel developers should review the fix and consider backporting it to stable kernel versions to ensure broader protection. Security teams should also verify that their vulnerability management processes account for this type of issue in the future, focusing on swift detection and response to similar memory leak vulnerabilities in the Linux kernel and other critical system components. Finally, users of Linux-based systems should ensure they have a robust patch management process in place to keep their systems up-to-date and secure, and consider engaging with Linux kernel developers and maintainers for support and guidance on mitigating this vulnerability effectively across their environments and supply chains, including cloud and IoT deployments that rely on Linux kernels for their operation and security posture, and to understand the full implications of this vulnerability on their specific use cases and configurations, and to prioritize and plan remediation efforts accordingly, taking into account potential operational impacts and dependencies on Linux kernel updates and patches for their systems and services, and to monitor for and respond to potential denial-of-service (DoS) attacks and other security incidents related to this vulnerability, and to implement additional security controls and mitigations as needed to protect their systems and data from potential threats and attacks, and to review and update their incident response plans and procedures to address this vulnerability and potential future vulnerabilities in the Linux kernel and other critical system components effectively and,

Technical summary

The vulnerability occurs in the ca8210_spi_transfer() function, which allocates cas_ctl with kzalloc_obj(GFP_ATOMIC) and relies on the SPI completion callback ca8210_spi_transfer_complete() to free it. However, when spi_async() fails, the completion callback is not invoked, leaving cas_ctl and its embedded spi_message and spi_transfer orphaned. The fix involves freeing cas_ctl on the spi_async() error path.

Defensive priority

Medium

Recommended defensive actions

• Inventory and assess Linux kernel installations for potential exposure
• Apply patches or updates to affected Linux kernel versions
• Monitor system logs for potential denial of service (DoS) attacks
• Implement compensating controls, such as rate limiting or traffic shaping
• Review and apply patches or updates to affected Linux kernel versions
• Verify that Linux kernel installations are up-to-date and secure
• Track and monitor Linux kernel updates and patches for potential security vulnerabilities

Evidence notes

The vulnerability was introduced in the Linux kernel's ieee802154 subsystem, specifically in the ca8210 driver. The issue occurs when the spi_async() function fails, causing the cas_ctl structure to be leaked. The vulnerability has been resolved by freeing cas_ctl on the spi_async() error path.

Official resources