CVE-2026-72486 Linux CVE debrief

Who should care

Linux kernel developers and users who rely on the mailbox mtk-adsp driver should be aware of this vulnerability. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retest remediated assets, and close the item only after evidence is documented. Asset inventory and security team should be informed about this vulnerability and its potential impact. Vulnerability management and operator should also be aware of this issue and take necessary actions to prevent exploitation. Rollback/change windows should be considered if necessary. Source tracking should be implemented to monitor the vulnerability and its potential impact. Security team should review this vulnerability and implement necessary controls to prevent exploitation. Security team should also review compensating controls for exposed systems and implement monitoring and detection to identify potential attacks. Security team should also track exceptions and retest remediated assets to ensure that the vulnerability is properly remediated. Security team should also close the item only after evidence is documented. Security team should also inform operator and vulnerability management about this vulnerability and its potential impact. Security team should also review this vulnerability and implement necessary controls to prevent exploitation. Security team should also review compensating controls for exposed systems and implement monitoring and detection to identify potential attacks. Security team should also track exceptions and retest remediated assets to ensure that the vulnerability is properly remediated. Security team should also close the item only after evidence is documented. Asset inventory should be informed about this vulnerability and its potential impact. Asset inventory should review this vulnerability and  

Technical summary

The Linux kernel has a use-after-free vulnerability in the mailbox mtk-adsp driver. When the SOF audio driver fails to initialize, its devres unwind frees the snd_sof_dev object that the mailbox client reaches via chan->cl->rx_callback. A late interrupt can still queue a threaded handler after mbox_free_channel() had cleared chan->cl, triggering a use-after-free. Disabling IRQ in shutdown and enabling IRQ in startup can prevent this issue. Additionally, requesting IRQ with IRQF_NO_AUTOEN can prevent early interrupts.

Defensive priority

High

Recommended defensive actions

• Disable IRQ in shutdown and enable IRQ in startup
• Request IRQ with IRQF_NO_AUTOEN
• Verify snd_sof_dev object is not freed prematurely
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was resolved by disabling IRQ in shutdown and enabling IRQ in startup. The IRQ is requested with IRQF_NO_AUTOEN to stay masked between probe and the first client bind. To verify, defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also check relevant monitoring, detection, and logs for exposed assets that need extra review.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.