Answer in brief
CVE-2026-72489 records a Unknown severity vulnerability in staging: nvec: fix use-after-free in nvec_rx_completed(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-72489 records a Unknown severity vulnerability in staging: nvec: fix use-after-free in nvec_rx_completed(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <6b2ea886ebdae44a2394029844a4e78f58e1587d || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <a37625c7b688fcf68a54263528eccbabfd7fa17a || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89 || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <08626fcfe12308ca3f8b22c538ba7dee0b2dce7a || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <f19a5bc059051143c489dd6f79a0f9c3bfd13aea || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90 || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <5de04caa46b635e180cecbd164e333eca535db94 || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <26813881181deb3a32fbb59eadb2599cbe8423f6 | 6b2ea886ebdae44a2394029844a4e78f58e1587d, a37625c7b688fcf68a54263528eccbabfd7fa17a, 9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89, 08626fcfe12308ca3f8b22c538ba7dee0b2dce7a, f19a5bc059051143c489dd6f79a0f9c3bfd13aea, bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90, 5de04caa46b635e180cecbd164e333eca535db94, 26813881181deb3a32fbb59eadb2599cbe8423f6 |
| Linux/Linuxgeneric | 3.2 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec_rx_completed() In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check.
Quoted source text, attributed separately from HOL analysis.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <6b2ea886ebdae44a2394029844a4e78f58e1587d || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <a37625c7b688fcf68a54263528eccbabfd7fa17a || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89 || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <08626fcfe12308ca3f8b22c538ba7dee0b2dce7a || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <f19a5bc059051143c489dd6f79a0f9c3bfd13aea || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90 || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <5de04caa46b635e180cecbd164e333eca535db94 || >=d6bdcf2e1019351cbc176e963b7756766bdd8721 <26813881181deb3a32fbb59eadb2599cbe8423f6 | 6b2ea886ebdae44a2394029844a4e78f58e1587d, a37625c7b688fcf68a54263528eccbabfd7fa17a, 9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89, 08626fcfe12308ca3f8b22c538ba7dee0b2dce7a, f19a5bc059051143c489dd6f79a0f9c3bfd13aea, bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90, 5de04caa46b635e180cecbd164e333eca535db94, 26813881181deb3a32fbb59eadb2599cbe8423f6 |
| Linux/Linuxgeneric | 3.2 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvec_rx_completed() In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type. Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free. Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check.
Quoted source text, attributed separately from HOL analysis.