Skip to main content

Linux Kernel nvec EUVDEUVD-2026-59388

| CVE-2026-72489 HIGH
2026-08-15 Linux GHSA-2v2r-3jf8-mfgg
Information Disclosure Linux Red Hat Suse
8.4
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition requires concurrent alloc/free timing (AC:H); local user access on Tegra hardware needed (PR:L, AV:L); UAF enables full kernel memory impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:50 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
8.4 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:57 cve.org
HIGH 8.4
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

staging: nvec: fix use-after-free in nvec_rx_completed()

In nvec_rx_completed(), when an incomplete RX transfer is detected, nvec_msg_free() is called to return the message back to the pool by clearing its 'used' atomic flag. Immediately after this, the code accesses nvec->rx->data[0] to check the message type.

Since nvec_msg_free() marks the pool slot as available via atomic_set(), any concurrent or subsequent call to nvec_msg_alloc() could claim that same slot and overwrite its data[] array. Reading nvec->rx->data[0] after freeing the message is therefore a use-after-free.

Fix this by saving the message type byte before calling nvec_msg_free(), then using the saved value for the battery quirk check.

AnalysisAI

Use-after-free in the Linux kernel staging nvec driver's nvec_rx_completed() function exposes Tegra-based systems to potential kernel memory corruption. The flaw arises from a TOCTOU race: nvec_msg_free() releases a message pool slot atomically, but the immediately following read of nvec->rx->data[0] occurs after that release - allowing a concurrent nvec_msg_alloc() to reclaim and overwrite the same slot. No public exploit has been identified at time of analysis, and the very low EPSS score (0.18%, 8th percentile) reflects the niche Tegra hardware prerequisite and staging driver context. Fixed commits are available across multiple stable kernel branches.

Technical ContextAI

The nvec (NVIDIA Embedded Controller) driver, located under drivers/staging/nvec in the Linux kernel, manages communication between host processors and an embedded controller on NVIDIA Tegra SoCs (Tegra 2/3 era). The driver uses a shared message pool with atomic 'used' flags for allocation and deallocation. The root cause is a classic use-after-free (effectively CWE-416, though the input lists CWE as N/A): nvec_msg_free() clears the pool slot's atomic flag, making it immediately eligible for reallocation by nvec_msg_alloc() on any concurrent code path. The subsequent read of nvec->rx->data[0] in the same function - intended as a battery quirk check - therefore reads from memory that may have been claimed and overwritten. This is a driver-level race in staging code, affecting the kernel memory space. The CPE cpe:2.3:a:linux:linux:* confirms the upstream Linux kernel as the affected software, with no downstream-specific variant identified.

RemediationAI

Apply the vendor-released stable kernel patches, which are available across all affected branches. Fixed versions are: Linux 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. Upstream fix commits are available at https://git.kernel.org/stable/c/08626fcfe12308ca3f8b22c538ba7dee0b2dce7a and the branch-specific equivalents listed in the CVE references. The fix saves nvec->rx->data[0] into a local variable before calling nvec_msg_free(), eliminating the race entirely. For systems that cannot immediately patch, a targeted workaround is to disable or blacklist the nvec kernel module (rmmod nvec / blacklist nvec in modprobe configuration), which prevents the driver from loading; this trades off NVEC hardware functionality (battery status, power management integration on Tegra) for elimination of the attack surface. Systems not running NVIDIA Tegra SoC hardware are unaffected and require no action.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-59388 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy