CVE-2026-72133: spi: uniphier: Fix completion initialization order before devm_request_irq()
In the Linux kernel, the following vulnerability has been resolved:
spi: uniphier: Fix completion initialization order before devmrequestirq()
The driver calls devmrequestirq() before initializing the completion used by the interrupt handler. Because the interrupt may occur immediately after devmrequestirq(), the handler may execute before initcompletion().
This may result in calling complete() on an uninitialized completion, causing undefined behavior. This has been observed with KASAN.
Fix this by initializing the completion before registering the IRQ.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the driver logic so that the completion object used by the interrupt handler is initialized (init_completion()) before registering the IRQ with devm_request_irq().
Linux kernel SPI driver: spi/uniphier completion initialization order (init_completion before devm_request_irq) = Initialize completion before calling devm_request_irq()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72133?
CVE-2026-72133 has a risk score of 37, indicating a low to moderate severity level.
How do I fix CVE-2026-72133?
To fix CVE-2026-72133, ensure that completion initialization occurs before the call to devm_request_irq() in the driver.
What systems are affected by CVE-2026-72133?
CVE-2026-72133 affects the Linux kernel's spi: uniphier driver.
What is the impact of CVE-2026-72133 if left unpatched?
If left unpatched, CVE-2026-72133 may lead to unexpected behavior due to interrupts occurring before proper initialization.
When was CVE-2026-72133 published?
CVE-2026-72133 was published on August 15, 2026.