CVE-2026-72489

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the nvec rx completed() function. When an incomplete RX transfer is detected, the nvec msg free() function is called to return the message to the pool by clearing its used atomic flag. The code then accesses nvec->rx->data[0] to verify the message type. Because nvec msg free() marks the pool slot as available via atomic set(), a concurrent or subsequent call to nvec msg alloc() could claim the same slot and overwrite the data[] array, leading to a use-after-free condition when reading the data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.