Strix
57.3K

CVE-2026-72037

UnknownEPSS 0.21%

Last modified

CVE-2026-72037 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Initialize eth_syslock spinlock before use lan743x_hardware_init() calls pci11x1x_strap_get_status() during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743x_hs_syslock_acquire(), which relies on adapter->eth_syslock_spinlock to serialize access. The spinlock is currently initialized only after the strap status is read. EPSS estimates a 0.21% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Initialize eth_syslock spinlock before use lan743x_hardware_init() calls pci11x1x_strap_get_status() during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743x_hs_syslock_acquire(), which relies on adapter->eth_syslock_spinlock to serialize access. The spinlock is currently initialized only after the strap status is read. With CONFIG_DEBUG_SPINLOCK enabled, taking the zeroed initialized spinlock can trip the spinlock debug check. Fix by initializing adapter->eth_syslock_spinlock before reading the strap status so the probe path never attempts to lock an uninitialized spinlock.

Metrics

EPSS Probability
0.21%

10.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 46b777ad9a8c269113634cee6a380bc4e53f3964, < dfaefd9a7808736fcd2ed0de108f55c4badc15cc; >= 46b777ad9a8c269113634cee6a380bc4e53f3964, < 6523daa6852b1bfef32ec7a105b0217e8a115687; >= 46b777ad9a8c269113634cee6a380bc4e53f3964, < b6a93a42e0e61f0ba0005a942ee3bffb16c0574e; >= 46b777ad9a8c269113634cee6a380bc4e53f3964, < 99a6f37b113c46815deb160c5012073563679ef4; >= 46b777ad9a8c269113634cee6a380bc4e53f3964, < b99e890e6b32ffa11c145a16fefcf2c7137a9578; >= 46b777ad9a8c269113634cee6a380bc4e53f3964, < 39139b1c1c2b614096519b526112c726adb12ff0
LinuxLinux6.0

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72037?
In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Initialize eth_syslock spinlock before use lan743x_hardware_init() calls pci11x1x_strap_get_status() during the PCI11x1x probe sequence. That helper acquires the Ethernet subsystem hardware lock via lan743x_hs_syslock_acquire(), which relies on adapter->eth_syslock_spinlock to serialize access. The spinlock is currently initialized only after the strap status is read. With CONFIG_DEBUG_SPINLOCK enabled, taking the zeroed initialized spinlock can trip the spinlock debug check. Fix by initializing adapter->eth_syslock_spinlock before reading the strap status so the probe path never attempts to lock an uninitialized spinlock.
How severe is CVE-2026-72037?
Severity scoring for CVE-2026-72037 is pending analysis. The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72037?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72037?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST