CVE-2026-72424 - Vulnerability Details

- rtc: msc313: fix NULL deref in shared IRQ handler at probe

Description

In the Linux kernel, the following vulnerability has been resolved:

rtc: msc313: fix NULL deref in shared IRQ handler at probe

msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and
&pdev->dev as the cookie, but platform_set_drvdata() is only called
later after the clock setup. With a shared IRQ line, another device
on the same line can trigger the handler in that window. The
handler does dev_get_drvdata() on the cookie, gets NULL, and
dereferences priv->rtc_base in interrupt context.

Pass priv as the cookie directly so the handler reads it from
dev_id without the lookup, removing the dependency on probe order.

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

During initialization of the msc313 RTC driver, a shared IRQ is requested before driver data is bound to the device. If another device sharing the IRQ triggers the handler while the data pointer is still NULL, the handler dereferences a NULL pointer in interrupt context, causing a kernel panic. This null pointer dereference (CWE‑476) results in a denial‑of‑service event.

Affected Systems

Any Linux kernel that includes the unpatched msc313 RTC driver is affected. The advisory does not list specific versions, so all releases containing the described probe sequence are potentially impacted unless the commit that passes the private data directly as the IRQ cookie has been applied.

Risk and Exploitability

The CVSS score of 5.5 signals a medium severity vulnerability, and the EPSS score of < 1% indicates a low probability of exploitation under normal circumstances. The flaw is exploitable only when another device shares the same IRQ line and can trigger it while the driver is in the vulnerable window, making it a local‑only attack vector. It is not listed in the CISA KEV catalog and thus has no known active exploit code, but a kernel panic can still be forced by a malicious or misbehaving peripheral in embedded or tightly coupled environments.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`be7d9c9161b9c76edeff15e79edc2f256568fe05`	affected	< ece7b9ffde23e2ccd7567761ac27463ded43932c
`be7d9c9161b9c76edeff15e79edc2f256568fe05`	affected	< 52c73b6992b46ed476590ed526faa033d4fbfc5d
`be7d9c9161b9c76edeff15e79edc2f256568fe05`	affected	< bc1f61a9b97d65de21c2681bcf0b5b1392c58486
`be7d9c9161b9c76edeff15e79edc2f256568fe05`	affected	< 1f6a4aec0d36647eb2f67cd69db22bd28cabe2cb
`be7d9c9161b9c76edeff15e79edc2f256568fe05`	affected	< bb3e624808c981fe881cb79037be63e680ed7d38
`be7d9c9161b9c76edeff15e79edc2f256568fe05`	affected	< a369f48be8de426a7d2bca18dbd46c2ad1138803

Linux

affected

Version	Status	Constraints
`5.16`	affected	—
`0`	unaffected	< 5.16
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[be7d9c9161b9c76edeff15e79edc2f256568fe05,ece7b9ffde23e2ccd7567761ac27463ded43932c)`	affected	code_commit	—
`[be7d9c9161b9c76edeff15e79edc2f256568fe05,52c73b6992b46ed476590ed526faa033d4fbfc5d)`	affected	code_commit	—
`[be7d9c9161b9c76edeff15e79edc2f256568fe05,bc1f61a9b97d65de21c2681bcf0b5b1392c58486)`	affected	code_commit	—
`[be7d9c9161b9c76edeff15e79edc2f256568fe05,1f6a4aec0d36647eb2f67cd69db22bd28cabe2cb)`	affected	code_commit	—
`[be7d9c9161b9c76edeff15e79edc2f256568fe05,bb3e624808c981fe881cb79037be63e680ed7d38)`	affected	code_commit	—
`[be7d9c9161b9c76edeff15e79edc2f256568fe05,a369f48be8de426a7d2bca18dbd46c2ad1138803)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.16`	affected	semver	—
`[0,5.16)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*)`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the commit passing private data directly as the IRQ cookie, removing the race condition.
Ensure driver data is bound to the device before calling devm_request_irq() so that the IRQ handler never receives a NULL cookie.
Reconfigure device or firmware to avoid sharing the IRQ line with other drivers that could trigger the fault window, or allocate a dedicated IRQ line for the RTC device.

Generated by OpenCVE AI on August 22, 2026 at 05:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1f6a4aec0d36647eb2f67cd69db22bd28cabe2cb
https://git.kernel.org/stable/c/52c73b6992b46ed476590ed526faa033d4fbfc5d
https://git.kernel.org/stable/c/a369f48be8de426a7d2bca18dbd46c2ad1138803
https://git.kernel.org/stable/c/bb3e624808c981fe881cb79037be63e680ed7d38
https://git.kernel.org/stable/c/bc1f61a9b97d65de21c2681bcf0b5b1392c58486
https://git.kernel.org/stable/c/ece7b9ffde23e2ccd7567761ac27463ded43932c
https://lore.kernel.org/linux-cve-announce/2026081526-CVE-2026-72424-de24@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72424
https://www.cve.org/CVERecord?id=CVE-2026-72424

History

Wed, 19 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026081526-CVE-2026-72424-de24@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72424 https://www.cve.org/CVERecord?id=CVE-2026-72424
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sat, 15 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: fix NULL deref in shared IRQ handler at probe msc313_rtc_probe() calls devm_request_irq() with IRQF_SHARED and &pdev->dev as the cookie, but platform_set_drvdata() is only called later after the clock setup. With a shared IRQ line, another device on the same line can trigger the handler in that window. The handler does dev_get_drvdata() on the cookie, gets NULL, and dereferences priv->rtc_base in interrupt context. Pass priv as the cookie directly so the handler reads it from dev_id without the lookup, removing the dependency on probe order.
Title		rtc: msc313: fix NULL deref in shared IRQ handler at probe
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1f6a4aec0d36647eb2f67cd69db22bd28cabe2cb https://git.kernel.org/stable/c/52c73b6992b46ed476590ed526faa033d4fbfc5d https://git.kernel.org/stable/c/a369f48be8de426a7d2bca18dbd46c2ad1138803 https://git.kernel.org/stable/c/bb3e624808c981fe881cb79037be63e680ed7d38 https://git.kernel.org/stable/c/bc1f61a9b97d65de21c2681bcf0b5b1392c58486 https://git.kernel.org/stable/c/ece7b9ffde23e2ccd7567761ac27463ded43932c

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:56:42.335Z

Updated: 2026-08-17T05:14:23.414Z

Reserved: 2026-08-09T03:40:39.928Z

Link: CVE-2026-72424

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:22:16.210

Modified: 2026-08-17T06:19:09.653

Link: CVE-2026-72424

Redhat

Severity : Low

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72424 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T05:30:17Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object