CVE-2026-72489

In the Linux kernel, the following vulnerability has been resolved:

staging: nvec: fix use-after-free in nvecrxcompleted()

In nvecrxcompleted(), when an incomplete RX transfer is detected, nvecmsgfree() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type.

Since nvecmsgfree() marks the pool slot as available via atomicset(), any concurrent or subsequent call to nvecmsg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free.

Fix this by saving the message type byte before calling nvecmsgfree(), then using the saved value for the battery quirk check.