CVE-2026-72133

HighCVSS 8.4

Published: 15/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

In the Linux kernel, the spi-uniphier driver has an initialization order issue: devm_request_irq() is called before initializing the completion used by the interrupt handler. This can lead to calling complete() on an uninitialized completion, causing undefined behavior (observed with KASAN).

Risk Assessment

Undefined behavior can lead to system crashes or unpredictable errors, potentially being exploited to destabilize the system.

Recommendation

Apply the patch from the Linux kernel update that initializes the completion before registering the IRQ (devm_request_irq()).

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: Fix completion initialization order before devm_request_irq() The driver calls devm_request_irq() before initializing the completion used by the interrupt handler. Because the interrupt may occur immediately after devm_request_irq(), the handler may execute before init_completion(). This may result in calling complete() on an uninitialized completion, causing undefined behavior. This has been observed with KASAN. Fix this by initializing the completion before registering the IRQ.