{"apiVersion":"1.0","identifier":"CVE-2026-72048","description":"In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix cas_ctl leak on spi_async failure ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC) and relies entirely on the SPI completion callback ca8210_spi_transfer_complete() to free it. The spi_async() API only invokes the completion callback on successful submission. On failure it returns a negative error code without ever queuing the callback, which leaves cas_ctl and its embedded spi_message and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is inside the completion callback, so there is no other reclamation path. ca8210_spi_transfer() is called from ca8210_spi_exchange(), the interrupt handler ca8210_interrupt_handler(), and from the retry path inside the completion callback itself. The exchange and interrupt handler paths loop on -EBUSY, so under sustained SPI bus contention every retry iteration leaks a fresh cas_ctl (~600 bytes per occurrence). Fix it by freeing cas_ctl on the spi_async() error path. While here, correct the misleading error string: the function calls spi_async(), not spi_sync().","publishedAt":"2026-08-15T06:21:14","lastModifiedAt":"2026-08-17T06:18:02","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72048","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00211,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72048","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72048","en":"https://www.redsauce.net/en/cves/CVE-2026-72048","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72048","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72048","de":"https://www.redsauce.net/de/cves/CVE-2026-72048","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72048","el":"https://www.redsauce.net/el/cves/CVE-2026-72048"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72048"}}