CVE-2026-72133

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-72133
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72133.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72133
Downstream
Published
2026-08-15T05:53:08.833Z
Modified
2026-08-18T03:56:37.779085853Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
spi: uniphier: Fix completion initialization order before devm_request_irq()
Details

In the Linux kernel, the following vulnerability has been resolved:

spi: uniphier: Fix completion initialization order before devmrequestirq()

The driver calls devmrequestirq() before initializing the completion used by the interrupt handler. Because the interrupt may occur immediately after devmrequestirq(), the handler may execute before init_completion().

This may result in calling complete() on an uninitialized completion, causing undefined behavior. This has been observed with KASAN.

Fix this by initializing the completion before registering the IRQ.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72133.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5ba155a4d4cc8e4cdd3db6df7d03271a3bd91177
Fixed
b9fcf0db433d79648ace74bc2b8b88f91e306304
Fixed
82a5746c4c9e94f6f816ec7edea6ddc24417c6a5
Fixed
f4bb0a91f7badd6d15ac8d783a1169d9e1e95c17
Fixed
49f6705d80b5e6175d8435d9c72b66bd516a8e89
Fixed
8b5798ce0007874c14611b8ee4ce6c749855260e
Fixed
d44b828eb551bd59ba9f22457825cc3db3a39fc1
Fixed
077a7bc1c32d3da9670c5e282ea3e5ac8a94be59
Fixed
f3ad1c87d8201e54b66bd6072442f0b5d5a308ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72133.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.19.0
Fixed
5.10.261
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.212
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.178
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.145
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.97
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.40
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72133.json"