CVE-2026-72048

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the ieee802154 driver for the ca8210 device. The function ca8210 spi transfer() allocates a cas ctl object using kzalloc obj(GFP ATOMIC) and expects the ca8210 spi transfer complete() callback to free it. However, if the spi async() API fails, it returns an error code without queuing the callback, leaving the cas ctl object, its embedded spi message, and spi transfer orphaned. This leak is triggered when ca8210 spi transfer() is called via ca8210 spi exchange(), the ca8210 interrupt handler() interrupt handler, or the retry path within the completion callback. Under sustained SPI bus contention, repeated retries on -EBUSY result in a leak of approximately 600 bytes per occurrence.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.