CVE-2026-72047

CVE CVE-2026-72047EUVD EUVD-2026-59005Published 2026-08-15T05:52:05.000ZLast changed 2026-08-17T05:07:12.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to kfifo_in()/kfifo_out(). This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the low 4 bytes of the 8-byte pointer are written into the FIFO. The reader then reads back 4 bytes into an 8-byte local pointer variable, leaving the upper 4 bytes uninitialized stack data. The first dereference of the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel address and generally results in an oops. Use sizeof(fifo_buffer) so the byte count matches pointer width on every architecture. The driver has no architecture restriction in Kconfig, so any 64-bit build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has been latent since the driver was added in 2017 because it is most commonly deployed on 32-bit MCUs. Found via a custom Coccinelle semantic patch hunting for short-byte kfifo I/O on byte-mode kfifos used to shuttle pointers.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 6.12.97; patch: 7.2; ded845a781a578dfb0b5b2c138e5a067aa3b1242 <093aacb0c56d5c693e3169a0224062e77c3fd0c0; ded845a781a578dfb0b5b2c138e5a067aa3b1242 <87dab14a4f68895d6f4d798e6ee3556cd64e8c72; patch: 5.10.261; patch: 7.1.5; 4.12; patch: 6.18.40; ded845a781a578dfb0b5b2c138e5a067aa3b1242 <2059c28bd725beded01277cdf1f67be33e714323; ded845a781a578dfb0b5b2c138e5a067aa3b1242 <6d7f7bcf225b2d566176bf6229dbd1252940cb3c; ded845a781a578dfb0b5b2c138e5a067aa3b1242 <2c1664ccfae653979b38788211240b5a1ee317ed; ded845a781a578dfb0b5b2c138e5a067aa3b1242 <1fe2643d0b24ca3cdd61a31a45c2d3233dc6cbfe; ded845a781a578dfb0b5b2c138e5a067aa3b1242 <d8ce67fa6a5e6929f5414e933ff9665176c2bce6; patch: 0; patch: 5.15.212; ded845a781a578dfb0b5b2c138e5a067aa3b1242 <65dc342274a01616f5c17105f7360a3b4bfd7a3d; patch: 6.1.178; patch: 6.6.145

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.