8.4
HIGH
CVSS 3.1
CVE-2026-72489
staging: nvec: fix use-after-free in nvec_rx_completed()
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec_rx_completed() In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check.
Details
INFO
Published Date :
Aug. 15, 2026, 6:22 a.m.
Last Modified :
Aug. 17, 2026, 6:19 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
Apply the kernel patch to save message type before freeing, preventing use-after-free.
- Apply the provided kernel patch.
- Review memory management in nvec_rx_completed().
- Test thoroughly after applying the patch.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72489.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72489 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72489
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72489 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72489 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '6b2ea886ebdae44a2394029844a4e78f58e1587d', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': 'a37625c7b688fcf68a54263528eccbabfd7fa17a', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '08626fcfe12308ca3f8b22c538ba7dee0b2dce7a', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': 'f19a5bc059051143c489dd6f79a0f9c3bfd13aea', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': 'bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '5de04caa46b635e180cecbd164e333eca535db94', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '26813881181deb3a32fbb59eadb2599cbe8423f6', 'versionType': 'git'}], 'programFiles': ['drivers/staging/nvec/nvec.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/staging/nvec/nvec.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '6b2ea886ebdae44a2394029844a4e78f58e1587d', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': 'a37625c7b688fcf68a54263528eccbabfd7fa17a', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '08626fcfe12308ca3f8b22c538ba7dee0b2dce7a', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': 'f19a5bc059051143c489dd6f79a0f9c3bfd13aea', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': 'bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '5de04caa46b635e180cecbd164e333eca535db94', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '26813881181deb3a32fbb59eadb2599cbe8423f6', 'versionType': 'git'}], 'programFiles': ['drivers/staging/nvec/nvec.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/staging/nvec/nvec.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '6b2ea886ebdae44a2394029844a4e78f58e1587d', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': 'a37625c7b688fcf68a54263528eccbabfd7fa17a', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '08626fcfe12308ca3f8b22c538ba7dee0b2dce7a', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': 'f19a5bc059051143c489dd6f79a0f9c3bfd13aea', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': 'bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '5de04caa46b635e180cecbd164e333eca535db94', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6bdcf2e1019351cbc176e963b7756766bdd8721', 'lessThan': '26813881181deb3a32fbb59eadb2599cbe8423f6', 'versionType': 'git'}], 'programFiles': ['drivers/staging/nvec/nvec.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/staging/nvec/nvec.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec_rx_completed() In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check. Added Reference https://git.kernel.org/stable/c/08626fcfe12308ca3f8b22c538ba7dee0b2dce7a Added Reference https://git.kernel.org/stable/c/26813881181deb3a32fbb59eadb2599cbe8423f6 Added Reference https://git.kernel.org/stable/c/5de04caa46b635e180cecbd164e333eca535db94 Added Reference https://git.kernel.org/stable/c/6b2ea886ebdae44a2394029844a4e78f58e1587d Added Reference https://git.kernel.org/stable/c/9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89 Added Reference https://git.kernel.org/stable/c/a37625c7b688fcf68a54263528eccbabfd7fa17a Added Reference https://git.kernel.org/stable/c/bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90 Added Reference https://git.kernel.org/stable/c/f19a5bc059051143c489dd6f79a0f9c3bfd13aea
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.