CVE-2026-72489: staging: nvec: fix use-after-free in nvec_rx_completed()
In the Linux kernel, the following vulnerability has been resolved:
staging: nvec: fix use-after-free in nvecrxcompleted()
In nvecrxcompleted(), when an incomplete RX transfer is detected, nvecmsgfree() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type.
Since nvecmsgfree() marks the pool slot as available via atomicset(), any concurrent or subsequent call to nvecmsgalloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free.
Fix this by saving the message type byte before calling nvecmsgfree(), then using the saved value for the battery quirk check.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In staging/nvec code, in nvec_rx_completed(), when an incomplete RX transfer is detected: save nvec->rx->data[0] (message type byte) before calling nvec_msg_free(), then after nvec_msg_free() use the saved message type for the battery quirk check instead of reading nvec->rx->data[0].
Linux kernel (staging: nvec) nvec_rx_completed() battery quirk check order = save nvec message type byte before calling nvec_msg_free() and use the saved value after