CVE-2026-72048

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: ca8210: fix casctl leak on spiasync failure

ca8210spitransfer() allocates casctl with kzallocobj(GFPATOMIC) and relies entirely on the SPI completion callback ca8210spitransfercomplete() to free it.

The spiasync() API only invokes the completion callback on successful submission. On failure it returns a negative error code without ever queuing the callback, which leaves casctl and its embedded spimessage and spitransfer orphaned. Every kfree(cas_ctl) in the driver is inside the completion callback, so there is no other reclamation path.

ca8210spitransfer() is called from ca8210spiexchange(), the interrupt handler ca8210interrupthandler(), and from the retry path inside the completion callback itself. The exchange and interrupt handler paths loop on -EBUSY, so under sustained SPI bus contention every retry iteration leaks a fresh cas_ctl (~600 bytes per occurrence).

Fix it by freeing casctl on the spiasync() error path. While here, correct the misleading error string: the function calls spiasync(), not spisync().