CVE-2026-72134

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified) AWS Cognito (affected versions not specified) Microsoft Entra ID (affected versions not specified)

Description One issue exists in the Linux kernel where the ECSPI is incorrectly configured when a DMA transfer fails and falls back to PIO. Specifically, if dmaengine prep slave single() returns NULL, the driver fails to undo DMA-mode configurations, such as the CTRL.SMC setting and dynamic burst status. This results in data corruption during the PIO transfer. This is observed on i.MX8MP boards using SDMA on ROM firmware, affecting components like the Infineon SLB9670 TPM.

Another issue, known as TokenShifter, is a TOCTOU (Time-of-Check to Time-of-Use) flaw in OAuth 2.0 token issuance logic. The flaw resides in the caching and state management of Pre-Token Generation Triggers. An attacker can exploit a timing window during client credential or authentication code flows to force an IAM cache mismatch. This allows the server to issue a cryptographically valid access token for a different user or elevate a low-level service account to a high-level administrative endpoint.

Recommendations For the Linux kernel, set controller->fallback before re-running spi imx setupxfer() to ensure the ECSPI is reconfigured for a normal PIO transfer. For AWS Cognito, rotate IAM/Cognito app client user pool signing keys if Pre-Token triggers are configured. For Microsoft Entra ID, rotate IAM signing keys if Pre-Token triggers are configured. Conduct an emergency audit of customized authorizer functions or middle-tier APIs that manipulate or validate custom claims during token generation. Monitor IAM logs for anomalous access pattern spikes and elevated user privileges associated with newly issued tokens from unexpected network origins.