« Volver al listado

CVE-2026-72047

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit

ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to kfifo_in()/kfifo_out().

This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the low 4 bytes of the 8-byte pointer are written into the FIFO. The reader then reads back 4 bytes into an 8-byte local pointer variable, leaving the upper 4 bytes uninitialized stack data. The first dereference of the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel address and generally results in an oops.

Leer descripción completaMostrar menos

Use sizeof(fifo_buffer) so the byte count matches pointer width on every architecture.

The driver has no architecture restriction in Kconfig, so any 64-bit build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has been latent since the driver was added in 2017 because it is most commonly deployed on 32-bit MCUs.

Found via a custom Coccinelle semantic patch hunting for short-byte kfifo I/O on byte-mode kfifos used to shuttle pointers.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72047",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "ded845a781a578dfb0b5b2c138e5a067aa3b1242",
              "lessThan": "2c1664ccfae653979b38788211240b5a1ee317ed",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ded845a781a578dfb0b5b2c138e5a067aa3b1242",
              "lessThan": "093aacb0c56d5c693e3169a0224062e77c3fd0c0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ded845a781a578dfb0b5b2c138e5a067aa3b1242",
              "lessThan": "87dab14a4f68895d6f4d798e6ee3556cd64e8c72",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ded845a781a578dfb0b5b2c138e5a067aa3b1242",
              "lessThan": "1fe2643d0b24ca3cdd61a31a45c2d3233dc6cbfe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ded845a781a578dfb0b5b2c138e5a067aa3b1242",
              "lessThan": "65dc342274a01616f5c17105f7360a3b4bfd7a3d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ded845a781a578dfb0b5b2c138e5a067aa3b1242",
              "lessThan": "2059c28bd725beded01277cdf1f67be33e714323",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ded845a781a578dfb0b5b2c138e5a067aa3b1242",
              "lessThan": "d8ce67fa6a5e6929f5414e933ff9665176c2bce6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ded845a781a578dfb0b5b2c138e5a067aa3b1242",
              "lessThan": "6d7f7bcf225b2d566176bf6229dbd1252940cb3c",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/ieee802154/ca8210.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/ieee802154/ca8210.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:21:13.933",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/093aacb0c56d5c693e3169a0224062e77c3fd0c0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1fe2643d0b24ca3cdd61a31a45c2d3233dc6cbfe",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2059c28bd725beded01277cdf1f67be33e714323",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2c1664ccfae653979b38788211240b5a1ee317ed",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/65dc342274a01616f5c17105f7360a3b4bfd7a3d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6d7f7bcf225b2d566176bf6229dbd1252940cb3c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/87dab14a4f68895d6f4d798e6ee3556cd64e8c72",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d8ce67fa6a5e6929f5414e933ff9665176c2bce6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nieee802154: ca8210: fix pointer truncation in kfifo on 64-bit\n\nca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange\na kmalloc'd buffer pointer through a struct kfifo, but pass a literal\n'4' as the byte count to kfifo_in()/kfifo_out().\n\nThis is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the\nlow 4 bytes of the 8-byte pointer are written into the FIFO. The reader\nthen reads back 4 bytes into an 8-byte local pointer variable, leaving\nthe upper 4 bytes uninitialized stack data. The first dereference of\nthe reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel\naddress and generally results in an oops.\n\nUse sizeof(fifo_buffer) so the byte count matches pointer width on every\narchitecture.\n\nThe driver has no architecture restriction in Kconfig, so any 64-bit\nbuild with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has\nbeen latent since the driver was added in 2017 because it is most\ncommonly deployed on 32-bit MCUs.\n\nFound via a custom Coccinelle semantic patch hunting for short-byte\nkfifo I/O on byte-mode kfifos used to shuttle pointers."
    }
  ],
  "lastModified": "2026-08-17T06:18:02.747",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}