{"id":"CVE-2026-72048","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-72048","generatedAt":"2026-10-28T04:03:56.471Z","title":"In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix cas_ctl leak on spi_async failure ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC) and relies entirely on the SPI completion callback…","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nieee802154: ca8210: fix cas_ctl leak on spi_async failure\n\nca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC)\nand relies entirely on the SPI completion callback\nca8210_spi_transfer_complete() to free it.\n\nThe spi_async() API only invokes the completion callback on successful\nsubmission.  On failure it returns a negative error code without ever\nqueuing the callback, which leaves cas_ctl and its embedded spi_message\nand spi_transfer orphaned.  Every kfree(cas_ctl) in the driver is\ninside the completion callback, so there is no other reclamation path.\n\nca8210_spi_transfer() is called from ca8210_spi_exchange(), the\ninterrupt handler ca8210_interrupt_handler(), and from the retry path\ninside the completion callback itself.  The exchange and interrupt\nhandler paths loop on -EBUSY, so under sustained SPI bus contention\nevery retry iteration leaks a fresh cas_ctl (~600 bytes per\noccurrence).\n\nFix it by freeing cas_ctl on the spi_async() error path.  While here,\ncorrect the misleading error string: the function calls spi_async(),\nnot spi_sync().","published":"2026-08-15T06:21:14.000Z","lastModified":"2026-08-17T06:18:03.000Z","status":"Received","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","cvss":null,"cwe":[],"affected":[],"epss":{"score":0.0022,"percentile":0.12391,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"unknown","text":"Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published."},"changes":[],"references":[{"url":"https://git.kernel.org/stable/c/460c5cd51e4d7d15b317f178f42cfcb666c0fe91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e3630fbb6aabb844bbf35746dee0bf3894100c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b07aea90dbc6e188c74c100af64b77b9482ffc65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9071dc7889bef42590e04fbf3e56cc65e1e5e6e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb5cca1d2a908ddd5e357971de0f2009617b8d6a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4a397fe803c2d157f6ebb068b802ef75fbf109e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e09390e439bd7cca30dd10893b1f64802961667a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe90605b651573d30be8293ff5be40e3d7023117","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72048","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}