CVE-2026-72486 (GCVE-0-2026-72486)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:15
VLAI
Title
mailbox: mtk-adsp: fix UAF during device teardown
Summary
In the Linux kernel, the following vulnerability has been resolved: mailbox: mtk-adsp: fix UAF during device teardown When the SOF audio driver fails to initialize (e.g. firmware boot timeout), its devres unwind frees the snd_sof_dev object that the mailbox client (mtk-adsp-ipc) reaches via chan->cl->rx_callback. The mtk-adsp-mailbox shutdown clears the mailbox command registers but leaves the IRQ line unmasked, so a late interrupt can still queue a threaded handler after mbox_free_channel() had cleared chan->cl, and mbox_chan_received_data() would then trigger UAF: BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version sof_ipc3_validate_fw_version sof_ipc3_do_rx_work sof_ipc3_rx_msg mt8196_dsp_handle_request mtk_adsp_ipc_recv mbox_chan_received_data mtk_adsp_mbox_isr irq_thread_fn Freed by task ...: kfree devres_release_all really_probe ... (sof-audio-of-mt8196 probe failure) The crash was observed roughly three seconds after the failed probe. disable_irq() in shutdown and enable_irq() in startup. disable_irq() also waits for any in-flight interrupts, so by the time mbox_free_channel() proceeds to clear chan->cl no rx_callback can run. In addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked between probe and the first client bind — otherwise an early interrupt can crash on chan->cl == NULL in mbox_chan_received_data().
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: af2dfa96c52d042df5deb29fb6e32d3ff4d76a61 , < b6337a08a63eef8efcffe3c01d479badda6bbbdb (git)
Affected: af2dfa96c52d042df5deb29fb6e32d3ff4d76a61 , < e519c1d8c5efb5cd8d4c5bb3fe39b1bbb812bdb9 (git)
Affected: af2dfa96c52d042df5deb29fb6e32d3ff4d76a61 , < fc6c3deb1d4c0adebf7dee0b8af4082af3f17690 (git)
Affected: af2dfa96c52d042df5deb29fb6e32d3ff4d76a61 , < 7d881615fb6373f71fc628b3f00186aeca87a3d5 (git)
Affected: af2dfa96c52d042df5deb29fb6e32d3ff4d76a61 , < 25d6ea6c76e1b1b7c57337b2f8f1b6fc8d5c52bc (git)
Affected: af2dfa96c52d042df5deb29fb6e32d3ff4d76a61 , < b57d1a40bc43258372fa1f4d39305e093947a262 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/mailbox/mtk-adsp-mailbox.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b6337a08a63eef8efcffe3c01d479badda6bbbdb",
              "status": "affected",
              "version": "af2dfa96c52d042df5deb29fb6e32d3ff4d76a61",
              "versionType": "git"
            },
            {
              "lessThan": "e519c1d8c5efb5cd8d4c5bb3fe39b1bbb812bdb9",
              "status": "affected",
              "version": "af2dfa96c52d042df5deb29fb6e32d3ff4d76a61",
              "versionType": "git"
            },
            {
              "lessThan": "fc6c3deb1d4c0adebf7dee0b8af4082af3f17690",
              "status": "affected",
              "version": "af2dfa96c52d042df5deb29fb6e32d3ff4d76a61",
              "versionType": "git"
            },
            {
              "lessThan": "7d881615fb6373f71fc628b3f00186aeca87a3d5",
              "status": "affected",
              "version": "af2dfa96c52d042df5deb29fb6e32d3ff4d76a61",
              "versionType": "git"
            },
            {
              "lessThan": "25d6ea6c76e1b1b7c57337b2f8f1b6fc8d5c52bc",
              "status": "affected",
              "version": "af2dfa96c52d042df5deb29fb6e32d3ff4d76a61",
              "versionType": "git"
            },
            {
              "lessThan": "b57d1a40bc43258372fa1f4d39305e093947a262",
              "status": "affected",
              "version": "af2dfa96c52d042df5deb29fb6e32d3ff4d76a61",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/mailbox/mtk-adsp-mailbox.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mtk-adsp: fix UAF during device teardown\n\nWhen the SOF audio driver fails to initialize (e.g. firmware boot\ntimeout), its devres unwind frees the snd_sof_dev object that the\nmailbox client (mtk-adsp-ipc) reaches via chan-\u003ecl-\u003erx_callback.\nThe mtk-adsp-mailbox shutdown clears the mailbox command registers\nbut leaves the IRQ line unmasked, so a late interrupt can still\nqueue a threaded handler after mbox_free_channel() had cleared\nchan-\u003ecl, and mbox_chan_received_data() would then trigger UAF:\n\n  BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version\n   sof_ipc3_validate_fw_version\n   sof_ipc3_do_rx_work\n   sof_ipc3_rx_msg\n   mt8196_dsp_handle_request\n   mtk_adsp_ipc_recv\n   mbox_chan_received_data\n   mtk_adsp_mbox_isr\n   irq_thread_fn\n  Freed by task ...:\n   kfree\n   devres_release_all\n   really_probe\n   ... (sof-audio-of-mt8196 probe failure)\n\nThe crash was observed roughly three seconds after the failed probe.\n\ndisable_irq() in shutdown and enable_irq() in startup. disable_irq()\nalso waits for any in-flight interrupts, so by the time\nmbox_free_channel() proceeds to clear chan-\u003ecl no rx_callback can run.\n\nIn addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked\nbetween probe and the first client bind \u2014 otherwise an early interrupt\ncan crash on chan-\u003ecl == NULL in mbox_chan_received_data()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:15:36.888Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b6337a08a63eef8efcffe3c01d479badda6bbbdb"
        },
        {
          "url": "https://git.kernel.org/stable/c/e519c1d8c5efb5cd8d4c5bb3fe39b1bbb812bdb9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc6c3deb1d4c0adebf7dee0b8af4082af3f17690"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d881615fb6373f71fc628b3f00186aeca87a3d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/25d6ea6c76e1b1b7c57337b2f8f1b6fc8d5c52bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b57d1a40bc43258372fa1f4d39305e093947a262"
        }
      ],
      "title": "mailbox: mtk-adsp: fix UAF during device teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72486",
    "datePublished": "2026-08-15T05:57:22.821Z",
    "dateReserved": "2026-08-09T03:40:39.936Z",
    "dateUpdated": "2026-08-17T05:15:36.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72486",
      "date": "2026-09-21",
      "epss": "0.00173",
      "percentile": "0.06993"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mailbox/mtk-adsp-mailbox.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b6337a08a63eef8efcffe3c01d479badda6bbbdb",
                    "status": "affected",
                    "version": "af2dfa96c52d042df5deb29fb6e32d3ff4d76a61",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e519c1d8c5efb5cd8d4c5bb3fe39b1bbb812bdb9",
                    "status": "affected",
                    "version": "af2dfa96c52d042df5deb29fb6e32d3ff4d76a61",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fc6c3deb1d4c0adebf7dee0b8af4082af3f17690",
                    "status": "affected",
                    "version": "af2dfa96c52d042df5deb29fb6e32d3ff4d76a61",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7d881615fb6373f71fc628b3f00186aeca87a3d5",
                    "status": "affected",
                    "version": "af2dfa96c52d042df5deb29fb6e32d3ff4d76a61",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "25d6ea6c76e1b1b7c57337b2f8f1b6fc8d5c52bc",
                    "status": "affected",
                    "version": "af2dfa96c52d042df5deb29fb6e32d3ff4d76a61",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b57d1a40bc43258372fa1f4d39305e093947a262",
                    "status": "affected",
                    "version": "af2dfa96c52d042df5deb29fb6e32d3ff4d76a61",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/mailbox/mtk-adsp-mailbox.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmailbox: mtk-adsp: fix UAF during device teardown\n\nWhen the SOF audio driver fails to initialize (e.g. firmware boot\ntimeout), its devres unwind frees the snd_sof_dev object that the\nmailbox client (mtk-adsp-ipc) reaches via chan-\u003ecl-\u003erx_callback.\nThe mtk-adsp-mailbox shutdown clears the mailbox command registers\nbut leaves the IRQ line unmasked, so a late interrupt can still\nqueue a threaded handler after mbox_free_channel() had cleared\nchan-\u003ecl, and mbox_chan_received_data() would then trigger UAF:\n\n  BUG: KASAN: slab-use-after-free in sof_ipc3_validate_fw_version\n   sof_ipc3_validate_fw_version\n   sof_ipc3_do_rx_work\n   sof_ipc3_rx_msg\n   mt8196_dsp_handle_request\n   mtk_adsp_ipc_recv\n   mbox_chan_received_data\n   mtk_adsp_mbox_isr\n   irq_thread_fn\n  Freed by task ...:\n   kfree\n   devres_release_all\n   really_probe\n   ... (sof-audio-of-mt8196 probe failure)\n\nThe crash was observed roughly three seconds after the failed probe.\n\ndisable_irq() in shutdown and enable_irq() in startup. disable_irq()\nalso waits for any in-flight interrupts, so by the time\nmbox_free_channel() proceeds to clear chan-\u003ecl no rx_callback can run.\n\nIn addition, request the IRQ with IRQF_NO_AUTOEN so it stays masked\nbetween probe and the first client bind \u2014 otherwise an early interrupt\ncan crash on chan-\u003ecl == NULL in mbox_chan_received_data()."
          }
        ],
        "id": "CVE-2026-72486",
        "lastModified": "2026-08-17T06:19:16.810",
        "metrics": {},
        "published": "2026-08-15T06:22:22.860",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/25d6ea6c76e1b1b7c57337b2f8f1b6fc8d5c52bc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7d881615fb6373f71fc628b3f00186aeca87a3d5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b57d1a40bc43258372fa1f4d39305e093947a262"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b6337a08a63eef8efcffe3c01d479badda6bbbdb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e519c1d8c5efb5cd8d4c5bb3fe39b1bbb812bdb9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fc6c3deb1d4c0adebf7dee0b8af4082af3f17690"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T16:07:06+00:00",
      "cve": "CVE-2026-72486",
      "id": "CVE-2026-72486",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mailbox: mtk-adsp: fix UAF during device teardown",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72486.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.