CVE-2026-72489
Received Received - Intake

Use-After-Free in Linux Kernel NVEC Driver

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec_rx_completed() In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72489
EUVD
EUVD-2026-59388

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's staging/nvec driver. It occurs when nvec_rx_completed() detects an incomplete RX transfer, calls nvec_msg_free() to return a message to the pool, and then immediately tries to access the freed message's data. Since nvec_msg_free() makes the pool slot available, another process could reuse that slot and overwrite the data, leading to a use-after-free condition when the original code tries to read the data.

Detection Guidance

This vulnerability is specific to the Linux kernel's staging driver nvec. Detection requires checking if your system uses the affected nvec driver. Inspect kernel logs for use-after-free errors or crashes related to nvec. Commands like dmesg | grep nvec or journalctl -k | grep nvec may help identify issues.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. It affects systems using the nvec driver, which is typically found in devices with NVIDIA Tegra processors.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-72489. If updating is not immediately possible, disable the nvec module by running modprobe -r nvec. Ensure no critical services depend on this module before disabling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72489. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart