CVE-2026-72485

In the Linux kernel, the following vulnerability has been resolved:

coresight: platform: defer connection counter increment until alloc succeeds

coresightaddoutconn() increments nroutconns before calling devmkreallocarray() and again before devm_kmalloc(). If either allocation fails, the counter is already bumped while the corresponding array entry is NULL or uninitialized garbage.

coresightaddinconn() has the same problem with nrinconns and devmkreallocarray().

In both cases the probe returns -ENOMEM, which causes coresightgetplatformdata() to call coresightreleaseplatformdata() for cleanup. That function iterates up to nroutconns (or nrinconns) entries and dereferences each pointer unconditionally, hitting the NULL or garbage entry and panicking instead of failing gracefully.

Fix by moving the counter increments to after all allocations succeed, so the struct is always consistent on any error path.