CVE-2026-72047

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit

ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange

a kmalloc'd buffer pointer through a struct kfifo, but pass a literal

'4' as the byte count to kfifo_in()/kfifo_out().

This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the

low 4 bytes of the 8-byte pointer are written into the FIFO. The reader

then reads back 4 bytes into an 8-byte local pointer variable, leaving

the upper 4 bytes uninitialized stack data. The first dereference of

the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel

address and generally results in an oops.

Use sizeof(fifo_buffer) so the byte count matches pointer width on every

architecture.

The driver has no architecture restriction in Kconfig, so any 64-bit

build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has

been latent since the driver was added in 2017 because

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References