CVE-2026-72048

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: ca8210: fix cas_ctl leak on spi_async failure

ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC)

and relies entirely on the SPI completion callback

ca8210_spi_transfer_complete() to free it.

The spi_async() API only invokes the completion callback on successful

submission. On failure it returns a negative error code without ever

queuing the callback, which leaves cas_ctl and its embedded spi_message

and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is

inside the completion callback, so there is no other reclamation path.

ca8210_spi_transfer() is called from ca8210_spi_exchange(), the

interrupt handler ca8210_interrupt_handler(), and from the retry path

inside the completion callback itself. The exchange and interrupt

handler paths loop on -EBUSY, so under sustained SPI bus contention

every retry iteration leaks a fresh cas_ctl (~600 bytes per

occurrence).

Fix it by free

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References