https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:41:28 +0000 https://vulnerability.circl.lu/vuln/cve-2026-72047 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit</p> <p>ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a kmalloc&#39;d buffer pointer through a struct kfifo, but pass a literal &#39;4&#39; as the byte count to kfifo_in()/kfifo_out().</p> <p>This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the low 4 bytes of the 8-byte pointer are written into the FIFO. The reader then reads back 4 bytes into an 8-byte local pointer variable, leaving the upper 4 bytes uninitialized stack data. The first dereference of the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel address and generally results in an oops.</p> <p>Use sizeof(fifo_buffer) so the byte count matches pointer width on every architecture.</p> <p>The driver has no architecture restriction in Kconfig, so any 64-bit build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has been latent since the driver was added in 2017 because it is most commonly deployed on 32-bit MCUs.</p> <p>Found via a custom Coccinelle semantic patch hunting for short-byte kfifo I/O on byte-mode kfifos used to shuttle pointers.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit</p> <p>ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a kmalloc&#39;d buffer pointer through a struct kfifo, but pass a literal &#39;4&#39; as the byte count to kfifo_in()/kfifo_out().</p> <p>This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the low 4 bytes of the 8-byte pointer are written into the FIFO. The reader then reads back 4 bytes into an 8-byte local pointer variable, leaving the upper 4 bytes uninitialized stack data. The first dereference of the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel address and generally results in an oops.</p> <p>Use sizeof(fifo_buffer) so the byte count matches pointer width on every architecture.</p> <p>The driver has no architecture restriction in Kconfig, so any 64-bit build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has been latent since the driver was added in 2017 because it is most commonly deployed on 32-bit MCUs.</p> <p>Found via a custom Coccinelle semantic patch hunting for short-byte kfifo I/O on byte-mode kfifos used to shuttle pointers.</p> https://vulnerability.circl.lu/vuln/cve-2026-72047