ieee802154: ca8210: fix cas_ctl leak on spi_async failure

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-72048
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 06:21:14 UTC
Updated2026-08-17 06:18:02 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix cas_ctl leak on spi_async failure ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC) and relies entirely on the SPI completion callback ca8210_spi_transfer_complete() to free it. The spi_async() API only invokes the completion callback on successful submission. On failure it returns a negative error code without ever queuing the callback, which leaves cas_ctl and its embedded spi_message and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is inside the completion callback, so there is no other reclamation path. ca8210_spi_transfer() is called from ca8210_spi_exchange(), the interrupt handler ca8210_interrupt_handler(), and from the retry path inside the completion callback itself. The exchange and interrupt handler paths loop on -EBUSY, so under sustained SPI bus contention every retry iteration leaks a fresh cas_ctl (~600 bytes per occurrence). Fix it by freeing cas_ctl on the spi_async() error path. While here, correct the misleading error string: the function calls spi_async(), not spi_sync().

Risk And Classification

EPSS: 0.002100000 probability, percentile 0.115350000 (date 2026-08-17)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 460c5cd51e4d7d15b317f178f42cfcb666c0fe91 git Not specified
CNA Linux Linux affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 b07aea90dbc6e188c74c100af64b77b9482ffc65 git Not specified
CNA Linux Linux affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 fe90605b651573d30be8293ff5be40e3d7023117 git Not specified
CNA Linux Linux affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 b9071dc7889bef42590e04fbf3e56cc65e1e5e6e git Not specified
CNA Linux Linux affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 d4a397fe803c2d157f6ebb068b802ef75fbf109e git Not specified
CNA Linux Linux affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 cb5cca1d2a908ddd5e357971de0f2009617b8d6a git Not specified
CNA Linux Linux affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 7e3630fbb6aabb844bbf35746dee0bf3894100c7 git Not specified
CNA Linux Linux affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 e09390e439bd7cca30dd10893b1f64802961667a git Not specified
CNA Linux Linux affected 4.12 Not specified
CNA Linux Linux unaffected 4.12 semver Not specified
CNA Linux Linux unaffected 5.10.261 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.212 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.178 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.145 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.97 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.40 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.5 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/e09390e439bd7cca30dd10893b1f64802961667a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/460c5cd51e4d7d15b317f178f42cfcb666c0fe91 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b9071dc7889bef42590e04fbf3e56cc65e1e5e6e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fe90605b651573d30be8293ff5be40e3d7023117 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/d4a397fe803c2d157f6ebb068b802ef75fbf109e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b07aea90dbc6e188c74c100af64b77b9482ffc65 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7e3630fbb6aabb844bbf35746dee0bf3894100c7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/cb5cca1d2a908ddd5e357971de0f2009617b8d6a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report