CVE-2026-72047

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A pointer truncation issue exists in the ieee802154 driver for ca8210 when running on 64-bit architectures with CONFIG IEEE802154 CA8210 DEBUGFS=y enabled. The functions ca8210 test int driver write() and ca8210 test int user read() use a struct kfifo to exchange a buffer pointer but incorrectly use a literal value of '4' as the byte count for kfifo in() and kfifo out(). While this works on 32-bit systems, on 64-bit systems only the lower 4 bytes of the 8-byte pointer are written. Consequently, the reader retrieves only 4 bytes into an 8-byte local pointer variable, leaving the upper 4 bytes as uninitialized stack data. Dereferencing the resulting pointer leads to an access of an arbitrary kernel address, typically resulting in a system oops.

Recommendations Update the ca8210 test int driver write() and ca8210 test int user read() functions to use sizeof(fifo buffer) instead of a literal '4' to ensure the byte count matches the pointer width across all architectures. As a temporary mitigation, disable the CONFIG IEEE802154 CA8210 DEBUGFS configuration option.