Description
In the Linux kernel, the following vulnerability has been resolved:

coresight: platform: defer connection counter increment until alloc succeeds

coresight_add_out_conn() increments nr_outconns before calling
devm_krealloc_array() and again before devm_kmalloc(). If either
allocation fails, the counter is already bumped while the corresponding
array entry is NULL or uninitialized garbage.

coresight_add_in_conn() has the same problem with nr_inconns and
devm_krealloc_array().

In both cases the probe returns -ENOMEM, which causes
coresight_get_platform_data() to call coresight_release_platform_data()
for cleanup. That function iterates up to nr_outconns (or nr_inconns)
entries and dereferences each pointer unconditionally, hitting the NULL
or garbage entry and panicking instead of failing gracefully.

Fix by moving the counter increments to after all allocations succeed,
so the struct is always consistent on any error path.
Published: 2026-08-15
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel contains a flaw in the CoreSight platform driver where the connection counter is incremented before successful memory allocation. If an allocation fails, the counter has already been increased while the corresponding array entry remains NULL or contains garbage. During cleanup the driver iterates over the counter and dereferences each entry unconditionally, which triggers a NULL or uninitialized pointer dereference and causes a kernel panic. The vulnerability is a classic NULL pointer dereference (CWE‑476) that results in a full denial of service for the affected system.

Affected Systems

Vendors: Linux. Product: Linux kernel (any release that includes the vulnerable CoreSight driver prior to the patch). The CVE does not list specific kernel releases, so any kernel that implements the CoreSight platform driver and predates the submitted commits may be vulnerable.

Risk and Exploitability

The flaw is a local kernel bug; exploitation requires the ability to provoke a memory allocation failure or to load/enable the CoreSight driver. An attacker with privileged access (or a path to load the module) can trigger the failure, potentially by exhausting memory or providing malformed data, which will then cause the kernel to panic. The CVSS score of 7.8 indicates high severity. The EPSS score is < 1%, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the known crash behavior gives the flaw a high impact in any scenario where the driver is reachable.

Generated by OpenCVE AI on August 17, 2026 at 14:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a kernel update that includes the CoreSight driver patch from commit 1563ae33dc4f5ebac96b93af2ef72e72aaaa31ae or 8ca9adc805884d3bb5038082462577f86c2c4a10.
  • If a patch is not yet available, blacklist or unload the coreSight driver to prevent the crash pathway from being invoked.
  • Restrict module loading to trusted users by configuring modprobe restrictions or a signed‑module policy, so that unprivileged users cannot load the CoreSight driver.

Generated by OpenCVE AI on August 17, 2026 at 14:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Mon, 17 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Mon, 17 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: coresight: platform: defer connection counter increment until alloc succeeds coresight_add_out_conn() increments nr_outconns before calling devm_krealloc_array() and again before devm_kmalloc(). If either allocation fails, the counter is already bumped while the corresponding array entry is NULL or uninitialized garbage. coresight_add_in_conn() has the same problem with nr_inconns and devm_krealloc_array(). In both cases the probe returns -ENOMEM, which causes coresight_get_platform_data() to call coresight_release_platform_data() for cleanup. That function iterates up to nr_outconns (or nr_inconns) entries and dereferences each pointer unconditionally, hitting the NULL or garbage entry and panicking instead of failing gracefully. Fix by moving the counter increments to after all allocations succeed, so the struct is always consistent on any error path.
Title coresight: platform: defer connection counter increment until alloc succeeds
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:44:47.818Z

Reserved: 2026-08-09T03:40:39.935Z

Link: CVE-2026-72485

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:22:22.767

Modified: 2026-08-17T06:19:16.710

Link: CVE-2026-72485

cve-icon Redhat

Severity : Low

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72485 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T14:15:04Z

Weaknesses