CVE-2026-72424: rtc: msc313: fix NULL deref in shared IRQ handler at probe
In the Linux kernel, the following vulnerability has been resolved:
rtc: msc313: fix NULL deref in shared IRQ handler at probe
msc313rtcprobe() calls devmrequestirq() with IRQFSHARED and &pdev->dev as the cookie, but platformsetdrvdata() is only called later after the clock setup. With a shared IRQ line, another device on the same line can trigger the handler in that window. The handler does devgetdrvdata() on the cookie, gets NULL, and dereferences priv->rtcbase in interrupt context.
Pass priv as the cookie directly so the handler reads it from devid without the lookup, removing the dependency on probe order.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72424?
CVE-2026-72424 has a risk score of 23, indicating a significant vulnerability in the Linux kernel.
How does CVE-2026-72424 affect the Linux kernel?
CVE-2026-72424 can lead to a NULL dereference in the shared IRQ handler during the probe process of the msc313 RTC driver.
How do I fix CVE-2026-72424?
To fix CVE-2026-72424, update your Linux kernel to a patched version where this vulnerability has been resolved.
What impact does CVE-2026-72424 have on system stability?
CVE-2026-72424 may cause system instability due to a potential crash when handling shared interrupts.
Is CVE-2026-72424 exploitable remotely?
CVE-2026-72424 is not directly exploitable remotely as it affects local IRQ handling in the kernel.