CVE-2026-72424

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rtc: msc313: fix NULL deref in shared IRQ handler at probe

msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and

&pdev->dev as the cookie, but platform_set_drvdata() is only called

later after the clock setup. With a shared IRQ line, another device

on the same line can trigger the handler in that window. The

handler does dev_get_drvdata() on the cookie, gets NULL, and

dereferences priv->rtc_base in interrupt context.

Pass priv as the cookie directly so the handler reads it from

dev_id without the lookup, removing the dependency on probe order.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References