- —Not scoredno CVSS score yet
- 0.22%Exploitation in 30 daysEPSS · top 87% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix cas_ctl leak on spi_async failure ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC) and relies entirely on the SPI completion callback ca8210_spi_transfer_complete() to free it. The spi_async() API only invokes the completion callback on successful submission. On failure it returns a negative error code without ever queuing the callback, which leaves cas_ctl and its embedded spi_message and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is inside the completion callback, so there is no other reclamation path. ca8210_spi_transfer() is called from ca8210_spi_exchange(), the interrupt handler ca8210_interrupt_handler(), and from the retry path inside the completion callback itself. The exchange and interrupt handler paths loop on -EBUSY, so under sustained SPI bus contention every retry iteration leaks a fresh cas_ctl (~600 bytes per occurrence). Fix it by freeing cas_ctl on the spi_async() error path. While here, correct the misleading error string: the function calls spi_async(), not spi_sync().
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (11 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 – < 460c5cd51e4d7d15b317f178f42cfcb666c0fe91
- affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 – < b07aea90dbc6e188c74c100af64b77b9482ffc65
- affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 – < fe90605b651573d30be8293ff5be40e3d7023117
- affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 – < b9071dc7889bef42590e04fbf3e56cc65e1e5e6e
- affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 – < d4a397fe803c2d157f6ebb068b802ef75fbf109e
- affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 – < cb5cca1d2a908ddd5e357971de0f2009617b8d6a
- affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 – < 7e3630fbb6aabb844bbf35746dee0bf3894100c7
- affected ded845a781a578dfb0b5b2c138e5a067aa3b1242 – < e09390e439bd7cca30dd10893b1f64802961667a
- affected 4.12
- unaffected < 4.12
- unaffected 5.10.261 – ≤ 5.10.*
- unaffected 5.15.212 – ≤ 5.15.*
- unaffected 6.1.178 – ≤ 6.1.*
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.97 – ≤ 6.12.*
- unaffected 6.18.40 – ≤ 6.18.*
- unaffected 7.1.5 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/460c5cd51e4d7d15b317f178f42cfcb666c0fe91 (opens in a new tab)
- https://git.kernel.org/stable/c/b07aea90dbc6e188c74c100af64b77b9482ffc65 (opens in a new tab)
- https://git.kernel.org/stable/c/fe90605b651573d30be8293ff5be40e3d7023117 (opens in a new tab)
- https://git.kernel.org/stable/c/b9071dc7889bef42590e04fbf3e56cc65e1e5e6e (opens in a new tab)
- https://git.kernel.org/stable/c/d4a397fe803c2d157f6ebb068b802ef75fbf109e (opens in a new tab)
- https://git.kernel.org/stable/c/cb5cca1d2a908ddd5e357971de0f2009617b8d6a (opens in a new tab)
- https://git.kernel.org/stable/c/7e3630fbb6aabb844bbf35746dee0bf3894100c7 (opens in a new tab)
- https://git.kernel.org/stable/c/e09390e439bd7cca30dd10893b1f64802961667a (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-59006 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-72048)Record last updated .