CVE-2026-72037: net: lan743x: Initialize eth_syslock spinlock before use
In the Linux kernel, the following vulnerability has been resolved:
net: lan743x: Initialize ethsyslock spinlock before use
lan743xhardwareinit() calls pci11x1xstrapgetstatus() during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743xhssyslockacquire(), which relies on adapter->ethsyslockspinlock to serialize access.
The spinlock is currently initialized only after the strap status is read. With CONFIGDEBUGSPINLOCK enabled, taking the zeroed initialized spinlock can trip the spinlock debug check.
Fix by initializing adapter->ethsyslockspinlock before reading the strap status so the probe path never attempts to lock an uninitialized spinlock.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72037?
CVE-2026-72037 has a risk rating of 12, indicating a critical severity level.
What systems are affected by CVE-2026-72037?
CVE-2026-72037 affects the Linux kernel, specifically in the context of the net: lan743x driver.
How do I fix CVE-2026-72037?
To fix CVE-2026-72037, update to the latest version of the Linux kernel where the vulnerability has been resolved.
What type of vulnerability is CVE-2026-72037?
CVE-2026-72037 is a vulnerability that involves improper initialization of the eth_syslock spinlock in the Linux kernel.
When was CVE-2026-72037 published?
CVE-2026-72037 was published on August 15, 2026.