CVE-2026-72133 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
spi: uniphier: Fix completion initialization order before devm_request_irq()
The driver calls devm_request_irq() before initializing the completion used by the interrupt handler. Because the interrupt may occur immediately after devm_request_irq(), the handler may execute before init_completion().
This may result in calling complete() on an uninitialized completion, causing undefined behavior. This has been observed with KASAN.
Fix this by initializing the completion before registering the IRQ.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical race condition in the Linux kernel's SPI driver for Uniphier platforms that stems from improper initialization sequencing of kernel synchronization primitives. This issue manifests when the spi_uniphier driver attempts to register an interrupt handler through devm_request_irq() before properly initializing the completion object that will be used by the interrupt service routine. The fundamental flaw lies in the temporal ordering of operations where the completion variable exists in an uninitialized state during the brief window between interrupt registration and completion initialization, creating a scenario where the interrupt handler may execute immediately upon registration and attempt to invoke complete() on an unprepared synchronization primitive.
The technical implications of this vulnerability extend beyond simple undefined behavior to potentially compromise system stability and security integrity. When the interrupt handler executes before init_completion() has been called, it attempts to signal an uninitialized completion object which can result in memory corruption patterns that KASAN (Kernel Address Sanitizer) has detected and reported. This race condition represents a classic example of improper resource initialization ordering that violates fundamental kernel development principles. The vulnerability directly maps to CWE-362, which addresses Race Conditions, and specifically relates to improper initialization of synchronization primitives in concurrent programming contexts where the timing of operations can lead to catastrophic failures.
The operational impact of this vulnerability is significant as it creates a window of opportunity for memory corruption that could be exploited by malicious actors. The immediate execution of interrupt handlers after registration means that any attacker with the ability to trigger the specific hardware condition that activates this driver path could potentially cause system crashes or more severe instability. The undefined behavior resulting from signaling uninitialized completions can lead to unpredictable memory layout corruption, potentially enabling privilege escalation or denial of service conditions. This vulnerability particularly affects embedded systems and SoC platforms that utilize Uniphier SPI controllers where the timing characteristics of interrupt delivery may be particularly sensitive to initialization order.
The fix implemented addresses this vulnerability through proper initialization sequencing by ensuring that completion objects are fully initialized before any interrupt registration occurs. This approach aligns with established kernel development best practices and follows the principle of proper resource management ordering. The solution demonstrates a clear understanding of concurrent programming patterns and the importance of temporal consistency in kernel drivers. By reordering the operations to initialize the completion prior to calling devm_request_irq(), the race condition is eliminated entirely, as the interrupt handler can no longer execute with an uninitialized synchronization primitive. This fix directly addresses the ATT&CK technique T1499.004, which involves network denial of service through kernel memory corruption, and represents a fundamental defensive measure against timing-based vulnerabilities in kernel space drivers that could otherwise be exploited to compromise system integrity. The remediation approach also reinforces proper kernel development methodologies and serves as a model for similar driver implementations across the Linux kernel ecosystem where interrupt handlers and synchronization primitives are involved.