CVE-2026-72489
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In the Linux kernel, in the staging nvec driver, nvec_rx_completed() has a use-after-free bug. After calling nvec_msg_free(), the code still reads nvec->rx->data[0], which may be overwritten by a concurrent nvec_msg_alloc() call. The fix saves the message type byte before freeing and uses the saved value.
Risk Assessment
Use-after-free can lead to system crashes or unpredictable driver behavior, potentially exploitable for attacks.
Recommendation
Apply the Linux kernel update containing this fix to prevent use-after-free in the nvec driver.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec_rx_completed() In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check.