CVE-2026-72037

Received Received - Intake

Use of Uninitialized Spinlock in lan743x Ethernet Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Initialize eth_syslock spinlock before use lan743x_hardware_init() calls pci11x1x_strap_get_status() during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743x_hs_syslock_acquire(), which relies on adapter->eth_syslock_spinlock to serialize access. The spinlock is currently initialized only after the strap status is read. With CONFIG_DEBUG_SPINLOCK enabled, taking the zeroed initialized spinlock can trip the spinlock debug check. Fix by initializing adapter->eth_syslock_spinlock before reading the strap status so the probe path never attempts to lock an uninitialized spinlock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72037

EUVD

EUVD-2026-58995

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a spinlock used for Ethernet subsystem access is not initialized before use. The lan743x_hardware_init function calls pci11x1x_strap_get_status during PCI probe, which tries to acquire an uninitialized spinlock. This can trigger debug checks in CONFIG_DEBUG_SPINLOCK builds.

Detection Guidance

This vulnerability is specific to the Linux kernel's lan743x driver and may not have direct detection commands. It involves an uninitialized spinlock in the PCI11x1x probe sequence. Check kernel logs for lan743x-related errors or spinlock debug warnings during driver initialization.

Impact Analysis

This vulnerability could cause system instability or crashes during network device initialization on systems using the lan743x driver with CONFIG_DEBUG_SPINLOCK enabled. It may lead to boot failures or kernel panics when the affected network hardware is detected.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a low-level Linux kernel issue involving an uninitialized spinlock in the lan743x network driver, which could cause system instability or crashes during hardware initialization. No data exposure or privacy implications are associated with this flaw.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-72037. The fix initializes the eth_syslock spinlock before use in the lan743x driver. Monitor kernel updates from your distribution.

Hi! I’m here to help you understand CVE-2026-72037. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70