CVE-2026-72109

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: unregister blocking notifier on init failure sparx5_register_notifier_blocks() registers the switchdev blocking notifier before allocating the ordered workqueue. If the workqueue allocation fails, the error path unregisters the switchdev and netdevice notifiers, but leaves the blocking notifier registered. Add a separate error label for the workqueue allocation failure path and unregister the switchdev blocking notifier there.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/17f113e7b622dc850992ade540181717de6a8561
https://git.kernel.org/stable/c/483be61b4a9a6df3b7cb277e8f189e082dee4cb8
https://git.kernel.org/stable/c/8a3c44a003176282ee4306b7c96e5a536c6f0707
https://git.kernel.org/stable/c/cf419c869e0d03aad4b6f4ecf0a813851930dfe7
https://git.kernel.org/stable/c/d6084c47389fd6978a5d66b0d58206a548c792a9
https://git.kernel.org/stable/c/e5afc6d3fabdf1f605d63c4b34a3df6c359e81f3
https://git.kernel.org/stable/c/fbc65b17508ed5464b7106e7fa5f15251ca1b603

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-15 06:21

Updated : 2026-08-17 06:18

NVD link : CVE-2026-72109

Mitre link : CVE-2026-72109

CVE.ORG link : CVE-2026-72109

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-72109", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d6fce5141929697a27f029c633433d487f6f62cb", "lessThan": "fbc65b17508ed5464b7106e7fa5f15251ca1b603", "versionType": "git"}, {"status": "affected", "version": "d6fce5141929697a27f029c633433d487f6f62cb", "lessThan": "e5afc6d3fabdf1f605d63c4b34a3df6c359e81f3", "versionType": "git"}, {"status": "affected", "version": "d6fce5141929697a27f029c633433d487f6f62cb", "lessThan": "cf419c869e0d03aad4b6f4ecf0a813851930dfe7", "versionType": "git"}, {"status": "affected", "version": "d6fce5141929697a27f029c633433d487f6f62cb", "lessThan": "d6084c47389fd6978a5d66b0d58206a548c792a9", "versionType": "git"}, {"status": "affected", "version": "d6fce5141929697a27f029c633433d487f6f62cb", "lessThan": "8a3c44a003176282ee4306b7c96e5a536c6f0707", "versionType": "git"}, {"status": "affected", "version": "d6fce5141929697a27f029c633433d487f6f62cb", "lessThan": "17f113e7b622dc850992ade540181717de6a8561", "versionType": "git"}, {"status": "affected", "version": "d6fce5141929697a27f029c633433d487f6f62cb", "lessThan": "483be61b4a9a6df3b7cb277e8f189e082dee4cb8", "versionType": "git"}], "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"status": "unaffected", "version": "0", "lessThan": "5.14", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/microchip/sparx5/sparx5_switchdev.c"], "defaultStatus": "affected"}]}], "published": "2026-08-15T06:21:25.203", "references": [{"url": "https://git.kernel.org/stable/c/17f113e7b622dc850992ade540181717de6a8561", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/483be61b4a9a6df3b7cb277e8f189e082dee4cb8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8a3c44a003176282ee4306b7c96e5a536c6f0707", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cf419c869e0d03aad4b6f4ecf0a813851930dfe7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d6084c47389fd6978a5d66b0d58206a548c792a9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e5afc6d3fabdf1f605d63c4b34a3df6c359e81f3", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fbc65b17508ed5464b7106e7fa5f15251ca1b603", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sparx5: unregister blocking notifier on init failure\n\nsparx5_register_notifier_blocks() registers the switchdev blocking\nnotifier before allocating the ordered workqueue. If the workqueue\nallocation fails, the error path unregisters the switchdev and netdevice\nnotifiers, but leaves the blocking notifier registered.\n\nAdd a separate error label for the workqueue allocation failure path and\nunregister the switchdev blocking notifier there."}], "lastModified": "2026-08-17T06:18:10.020", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}