CVE-2026-72489 staging: nvec: fix use-after-free in nvec_rx_completed()

🗓️ 15 Aug 2026 05:57:24Reported by LinuxType

Use-after-free in nvec_rx_completed() accesses freed message data before pool release in Linux kernel nvec driver.

Reporter	Title	Published	Views	Family All 64
BDU FSTEC	Linux kernel nvec_rx_completed() Heap Buffer Overflow	12 Oct 202600:00	–	bdu_fstec
CVE	CVE-2026-72489	15 Aug 202605:57	–	cve
Debian CVE	CVE-2026-72489	15 Aug 202605:57	–	debiancve
EUVD	EUVD-2026-59388	15 Aug 202605:57	–	euvd
NVD	CVE-2026-72489	15 Aug 202606:22	–	nvd
osv_bell	BELL-CVE-2026-72489	18 Aug 202606:06	–	osv_bell
osv_debian	DEBIAN-CVE-2026-72489	15 Aug 202606:22	–	osv_debian
osv_suse	SUSE-SU-2026:5091-1 Security update for the Linux Kernel	3 Nov 202616:27	–	osv_suse
osv_ubuntu	UBUNTU-CVE-2026-72489	15 Aug 202606:22	–	osv_ubuntu
osv_usn	USN-8781-1 linux-nvidia-tegra vulnerabilities	18 Sep 202608:50	–	osv_usn

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/staging/nvec/nvec.c"
    ],
    "versions": [
      {
        "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
        "lessThan": "6b2ea886ebdae44a2394029844a4e78f58e1587d",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
        "lessThan": "a37625c7b688fcf68a54263528eccbabfd7fa17a",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
        "lessThan": "9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
        "lessThan": "08626fcfe12308ca3f8b22c538ba7dee0b2dce7a",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
        "lessThan": "f19a5bc059051143c489dd6f79a0f9c3bfd13aea",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
        "lessThan": "bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
        "lessThan": "5de04caa46b635e180cecbd164e333eca535db94",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "d6bdcf2e1019351cbc176e963b7756766bdd8721",
        "lessThan": "26813881181deb3a32fbb59eadb2599cbe8423f6",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/staging/nvec/nvec.c"
    ],
    "versions": [
      {
        "version": "3.2",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "3.2",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.10.261",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "5.15.212",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.1.178",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.6.145",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.12.97",
        "lessThanOrEqual": "6.12.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "6.18.40",
        "lessThanOrEqual": "6.18.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.1.5",
        "lessThanOrEqual": "7.1.*",
        "status": "unaffected",
        "versionType": "semver"
      },
      {
        "version": "7.2",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]

Source	Link
git	www.git.kernel.org/stable/c/08626fcfe12308ca3f8b22c538ba7dee0b2dce7a
git	www.git.kernel.org/stable/c/5de04caa46b635e180cecbd164e333eca535db94
git	www.git.kernel.org/stable/c/a37625c7b688fcf68a54263528eccbabfd7fa17a
git	www.git.kernel.org/stable/c/6b2ea886ebdae44a2394029844a4e78f58e1587d
git	www.git.kernel.org/stable/c/f19a5bc059051143c489dd6f79a0f9c3bfd13aea
git	www.git.kernel.org/stable/c/26813881181deb3a32fbb59eadb2599cbe8423f6
git	www.git.kernel.org/stable/c/9f7fe4165a1f1014bdadc8e744c0fd3c2d8c0b89
git	www.git.kernel.org/stable/c/bb3d592c7d6c4ec8ac6640c690ca13298e7e8e90

17 Aug 2026 05:44Current

CVSS 3.18.4

EPSS0.0019