CVE-2026-72047
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to kfifo_in()/kfifo_out(). This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the low 4 bytes of the 8-byte pointer are written into the FIFO. The reader then reads back 4 bytes into an 8-byte local pointer variable, leaving the upper 4 bytes uninitialized stack data. The first dereference of the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel address and generally results in an oops. Use sizeof(fifo_buffer) so the byte count matches pointer width on every architecture. The driver has no architecture restriction in Kconfig, so any 64-bit build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has been latent since the driver was added in 2017 because it is most commonly deployed on 32-bit MCUs. Found via a custom Coccinelle semantic patch hunting for short-byte kfifo I/O on byte-mode kfifos used to shuttle pointers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72047
EUVD
EUVD-2026-59005

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ieee802154 ca8210 From 2017 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a pointer truncation vulnerability in the Linux kernel's ieee802154 ca8210 driver. It occurs when a buffer pointer is passed through a struct kfifo between two functions, ca8210_test_int_driver_write() and ca8210_test_int_user_read(). The functions incorrectly use a fixed byte count of 4 when writing or reading the pointer, which works on 32-bit systems but fails on 64-bit systems. On 64-bit systems, only the lower 4 bytes of the 8-byte pointer are stored, leaving the upper 4 bytes uninitialized. When the pointer is reconstructed, it points to an arbitrary kernel memory location, leading to a kernel oops upon dereference.

Detection Guidance

This vulnerability affects the Linux kernel's ieee802154 ca8210 driver when CONFIG_IEEE802154_CA8210_DEBUGFS=y is enabled on 64-bit systems. Detection requires checking kernel configuration and driver usage. No direct commands are provided in the context to detect this specific issue.

Impact Analysis

If you are running a 64-bit Linux system with the CONFIG_IEEE802154_CA8210_DEBUGFS kernel configuration enabled, this vulnerability could cause your system to crash (kernel oops) when the affected driver is used. This could lead to denial of service or potential unauthorized memory access, depending on the attacker's capabilities and system configuration.

Mitigation Strategies

Disable the vulnerable driver by setting CONFIG_IEEE802154_CA8210_DEBUGFS to 'n' in the kernel configuration and recompiling. Alternatively, apply a kernel patch that fixes the pointer truncation issue in ca8210_test_int_driver_write() and ca8210_test_int_user_read().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72047. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart